-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.user Processes.process_name Processes.process Processes.dest
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) by Processes.user Processes.process_name Processes.process Processes.dest Processes.process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
@@ -13077,6 +13169,8 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th
* [[Documentation:ESSOC:stories:UseCase#Credential_Dumping|Credential Dumping]]
+* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]]
+
====How To Implement====
You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.
@@ -13401,6 +13495,8 @@ The following query identifies Microsoft Background Intelligent Transfer Service
* [[Documentation:ESSOC:stories:UseCase#BITS_Jobs|BITS Jobs]]
+* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]]
+
====How To Implement====
To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -13540,6 +13636,92 @@ It is possible for this search to generate a notable event for a batch file writ
* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/batch_file_in_system32/windows-sysmon.log
+''version'': 1
+
+
+
+----
+
+===Cmlua or cmstplua uac bypass===
+This analytic detects a potential process using COM Object like CMLUA or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries to gain administrative privileges to its running process.
+
+* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+* '''Datamodel''': Endpoint
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1218/003/ T1218.003]
+* '''Last Updated''': 2021-05-13
+
+
+
+
+====Search====
+`sysmon` EventCode=7 ImageLoaded IN ("*\\CMLUA.dll", "*\\CMSTPLUA.dll", "*\\CMLUAUTIL.dll") NOT(process_name IN("CMSTP.exe", "CMMGR32.exe")) NOT(Image IN("*\\windows\\*", "*\\program files*"))
+| stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `cmlua_or_cmstplua_uac_bypass_filter`
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]]
+
+* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]]
+
+
+====How To Implement====
+To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+
+====Required field====
+
+* _time
+
+* Image
+
+* ImageLoaded
+
+* process_name
+
+* Computer
+
+* EventCode
+
+* Signed
+
+* ProcessId
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1218.003
+| CMSTP
+| Defense Evasion
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+Legitimate windows application that are not on the list loading this dll. Filter as needed.
+
+====Reference====
+
+
+* https://attack.mitre.org/techniques/T1218/003/
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/darkside_cmstp_com/windows-sysmon.log
+
+
''version'': 1
====Search====
-
`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\wkssvc*, \\DserNamePipe*, \\srvsvc_*, \\mojo.*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*, \\ntsvcs*, \\winsock*)
+`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\wkssvc*, \\DserNamePipe*, \\srvsvc_*, \\mojo.*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*, \\ntsvcs*, \\winsock*, \\UIA_PIPE*)
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name, process_id process_path, PipeName
| rename Computer as dest
| `security_content_ctime(firstTime)`
@@ -14143,6 +14329,10 @@ Upon triage, review the process performing the named pipe. If it is explorer.exe
* [[Documentation:ESSOC:stories:UseCase#Cobalt_Strike|Cobalt Strike]]
+* [[Documentation:ESSOC:stories:UseCase#Trickbot|Trickbot]]
+
+* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]]
+
====How To Implement====
To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
@@ -14198,6 +14388,8 @@ The idea of using named pipes with Cobalt Strike is to blend in. Therefore, some
* https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752
+* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+
====Test Dataset====
@@ -17640,6 +17832,8 @@ This search looks for reading loaded Images unique to credential dumping with Mi
* [[Documentation:ESSOC:stories:UseCase#Cloud_Federated_Credential_Abuse|Cloud Federated Credential Abuse]]
+* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]]
+
====How To Implement====
This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 7 with powershell.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
@@ -18241,6 +18435,8 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla
* [[Documentation:ESSOC:stories:UseCase#HAFNIUM_Group|HAFNIUM Group]]
+* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]]
+
====How To Implement====
You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
@@ -18293,6 +18489,97 @@ Administrators can leverage PsExec for accessing remote systems and might pass `
----
+===Detect rclone command-line usage===
+This analytic identifies commonly used command-line arguments used by `rclone.exe` to initiate a file transfer. Some arguments were negated as they are specific to the configuration used by adversaries. In particular, an adversary may list the files or directories of the remote file share using `ls` or `lsd`, which is not indicative of malicious behavior. During triage, at this stage of a ransomware event, exfiltration is about to occur or has already. Isolate the endpoint and continue investigating by review file modifications and parallel processes.
+
+* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+* '''Datamodel''': Endpoint
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1020/ T1020]
+* '''Last Updated''': 2021-05-13
+
+
+
+
+====Search====
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*copy*", "*mega*", "*pcloud*", "*ftp*", "*--config*", "*--progress*", "*--no-check-certificate*", "*--ignore-existing*", "*--auto-confirm*", "*--transfers*", "*--multi-thread-streams*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+| `drop_dm_object_name(Processes)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `detect_rclone_command_line_usage_filter`
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]]
+
+* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]]
+
+
+====How To Implement====
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+
+====Required field====
+
+* _time
+
+* Processes.dest
+
+* Processes.user
+
+* Processes.parent_process
+
+* Processes.process_name
+
+* Processes.process
+
+* Processes.process_id
+
+* Processes.parent_process_id
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1020
+| Automated Exfiltration
+| Exfiltration
+|}
+
+
+====Kill Chain Phase====
+
+* Exfiltration
+
+
+====Known False Positives====
+There is potential for false positives as these arguments may be used by other applications. Filter or tune the analytic as needed.
+
+====Reference====
+
+
+* https://redcanary.com/blog/rclone-mega-extortion/
+
+* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+
+* https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log
+
+
+''version'': 1
+
+
+
+
+====Search====
+`sysmon` EventID=1 OriginalFileName=rclone.exe NOT process_name=rclone.exe
+| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine
+| rename Computer as dest
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `detect_renamed_rclone_filter`
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]]
+
+* [[Documentation:ESSOC:stories:UseCase#Ransomware|Ransomware]]
+
+
+====How To Implement====
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+
+====Required field====
+
+* _time
+
+* OriginalFileName
+
+* process_name
+
+* process_path
+
+* CommandLine
+
+* dest
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1020
+| Automated Exfiltration
+| Exfiltration
+|}
+
+
+====Kill Chain Phase====
+
+* Exfiltration
+
+
+====Known False Positives====
+False positives should be limited as this analytic identifies renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business use case.
+
+====Reference====
+
+
+* https://redcanary.com/blog/rclone-mega-extortion/
+
+* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+
+* https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log
+
+
''version'': 1
+
+
+====Search====
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=reg.exe (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process=*sam* OR Processes.process=*system* OR Processes.process=*security*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+| `drop_dm_object_name(Processes)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `extract_sam_from_registry_filter`
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]]
+
+* [[Documentation:ESSOC:stories:UseCase#Credential_Dumping|Credential Dumping]]
+
+
+====How To Implement====
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+
+====Required field====
+
+* _time
+
+* Processes.dest
+
+* Processes.user
+
+* Processes.parent_process
+
+* Processes.process_name
+
+* Processes.process
+
+* Processes.process_id
+
+* Processes.parent_process_id
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1003.002
+| Security Account Manager
+| Credential Access
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+It is possible some agent based products will generate false positives. Filter as needed.
+
+====Reference====
+
+
+* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+
+* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log
+
+
+''version'': 1
+
+
+
+
+====Search====
+`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12
+| bucket span=2m _time
+| stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address
+| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address
+| eval upperBound=(comp_avg+comp_std*3)
+| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
+| search isOutlier=1
+| `multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos_filter`
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Active_Directory_Password_Spraying|Active Directory Password Spraying]]
+
+
+====How To Implement====
+To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+
+====Required field====
+
+* _time
+
+* EventCode
+
+* Result_Code
+
+* Account_Name
+
+* Client_Address
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1110.003
+| Password Spraying
+| Credential Access
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems missconfigured systems.
+
+====Reference====
+
+
+* https://attack.mitre.org/techniques/T1110/003/
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log
+
+
+''version'': 1
+
+
+
+
+====Search====
+`wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$"
+| bucket span=2m _time
+| stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address
+| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address
+| eval upperBound=(comp_avg+comp_std*3)
+| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
+| search isOutlier=1
+| `multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos_filter`
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Active_Directory_Password_Spraying|Active Directory Password Spraying]]
+
+
+====How To Implement====
+To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+
+====Required field====
+
+* _time
+
+* EventCode
+
+* Result_Code
+
+* Account_Name
+
+* Client_Address
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1110.003
+| Password Spraying
+| Credential Access
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems and missconfigured systems.
+
+====Reference====
+
+
+* https://attack.mitre.org/techniques/T1110/003/
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos/windows-security.log
+
+
+''version'': 1
+
+
+
+
+====Search====
+ `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 action=failure
+| bucket span=2m _time
+| stats dc(Logon_Account) AS unique_accounts values(Logon_Account) as tried_accounts by _time, Source_Workstation
+| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation
+| eval upperBound=(comp_avg+comp_std*3)
+| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
+| search isOutlier=1
+| `multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter`
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Active_Directory_Password_Spraying|Active Directory Password Spraying]]
+
+
+====How To Implement====
+To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation' within `Account Logon` needs to be enabled.
+
+====Required field====
+
+* _time
+
+* EventCode
+
+* action
+
+* Logon_Account
+
+* Source_Workstation
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1110.003
+| Password Spraying
+| Credential Access
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host's local accounts.
+
+====Reference====
+
+
+* https://attack.mitre.org/techniques/T1110/003/
+
+* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation
+
+* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm/windows-security.log
+
+
+''version'': 1
+
+
+
+
+====Search====
+ `wineventlog_security` EventCode=4648
+| bucket span=2m _time
+| eval Source_Account = mvindex(Account_Name, 0)
+| eval Destination_Account = mvindex(Account_Name, 1)
+| search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$"
+| stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_account by _time, ComputerName, Source_Account
+| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by ComputerName
+| eval upperBound=(comp_avg+comp_std*3)
+| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
+| search isOutlier=1
+| `multiple_users_attempting_to_authenticate_using_explicit_credentials_filter`
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Active_Directory_Password_Spraying|Active Directory Password Spraying]]
+
+
+====How To Implement====
+To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled.
+
+====Required field====
+
+* _time
+
+* EventCode
+
+* Security_ID
+
+* Account_Name
+
+* ComputerName
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1110.003
+| Password Spraying
+| Credential Access
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. Some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list. Possible false positive scenarios include systems where several users connect to like Mail servers, identity providers, remote desktop services, Citrix, etc.
+
+====Reference====
+
+
+* https://attack.mitre.org/techniques/T1110/003/
+
+* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648
+
+* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray/windows-security.log
+
+
+''version'': 1
+
+
+
+
+====Search====
+`wineventlog_security` EventCode=4771 Failure_Code=0x18 Account_Name!="*$"
+| bucket span=2m _time
+| stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address
+| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address
+| eval upperBound=(comp_avg+comp_std*3)
+| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
+| search isOutlier=1
+| `multiple_users_failing_to_authenticate_from_host_using_kerberos_filter`
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Active_Directory_Password_Spraying|Active Directory Password Spraying]]
+
+
+====How To Implement====
+To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+
+====Required field====
+
+* _time
+
+* EventCode
+
+* Result_Code
+
+* Account_Name
+
+* Client_Address
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1110.003
+| Password Spraying
+| Credential Access
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+A host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, missconfigured systems and multi-user systems like Citrix farms.
+
+====Reference====
+
+
+* https://attack.mitre.org/techniques/T1110/003/
+
+* https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn319109(v=ws.11)
+
+* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4771
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos/windows-security.log
+
+
+''version'': 1
+
+
+
+
+====Search====
+ `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC000006A action=failure
+| bucket span=2m _time
+| stats dc(Logon_Account) AS unique_accounts values(Logon_Account) as tried_accounts by _time, Source_Workstation
+| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation
+| eval upperBound=(comp_avg+comp_std*3)
+| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
+| search isOutlier=1
+| `multiple_users_failing_to_authenticate_from_host_using_ntlm_filter`
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Active_Directory_Password_Spraying|Active Directory Password Spraying]]
+
+
+====How To Implement====
+To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation` within `Account Logon` needs to be enabled.
+
+====Required field====
+
+* _time
+
+* EventCode
+
+* action
+
+* Logon_Account
+
+* Source_Workstation
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1110.003
+| Password Spraying
+| Credential Access
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+A host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host's local accounts.
+
+====Reference====
+
+
+* https://attack.mitre.org/techniques/T1110/003/
+
+* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation
+
+* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm/windows-security.log
+
+
+''version'': 1
+
+
+
+
+====Search====
+ `wineventlog_security` EventCode=4625 Logon_Type=2 Caller_Process_Name!="-"
+| bucket span=2m _time
+| eval Source_Account = mvindex(Account_Name, 0)
+| eval Destination_Account = mvindex(Account_Name, 1)
+| stats dc(Destination_Account) AS unique_accounts values(Account_Name) as tried_accounts by _time, Caller_Process_Name, Source_Account, ComputerName
+| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Caller_Process_Name, Source_Account, ComputerName
+| eval upperBound=(comp_avg+comp_std*3)
+| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
+| search isOutlier=1
+| `multiple_users_failing_to_authenticate_from_process_filter`
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Active_Directory_Password_Spraying|Active Directory Password Spraying]]
+
+
+====How To Implement====
+To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers aas well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled.
+
+====Required field====
+
+* _time
+
+* EventCode
+
+* Logon_Type
+
+* Caller_Process_Name
+
+* Security_ID
+
+* Account_Name
+
+* ComputerName
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1110.003
+| Password Spraying
+| Credential Access
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+A process failing to authenticate with multiple users is not a common behavior for legitimate user sessions. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems.
+
+====Reference====
+
+
+* https://attack.mitre.org/techniques/T1110/003/
+
+* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
+
+* https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625
+
+* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process/windows-security.log
+
+
+''version'': 1
+
+
+
+
+====Search====
+ `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Address!="-"
+| bucket span=2m _time
+| eval Destination_Account = mvindex(Account_Name, 1)
+| stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts by _time, Source_Network_Address, ComputerName
+| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName
+| eval upperBound=(comp_avg+comp_std*3)
+| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
+| search isOutlier=1
+| `multiple_users_remotely_failing_to_authenticate_from_host_filter`
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Active_Directory_Password_Spraying|Active Directory Password Spraying]]
+
+
+====How To Implement====
+To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled.
+
+====Required field====
+
+* _time
+
+* EventCode
+
+* Logon_Type
+
+* Security_ID
+
+* Account_Name
+
+* ComputerName
+
+* Source_Network_Address
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1110.003
+| Password Spraying
+| Credential Access
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+A host failing to authenticate with multiple valid users against a remote host is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, missconfigyred systems, etc.
+
+====Reference====
+
+
+* https://attack.mitre.org/techniques/T1110/003/
+
+* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
+
+* https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625
+
+* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray/windows-security.log
+
+
''version'': 1
====Search====
-
`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "wordpad.exe") ImageLoaded = "*\\taskschd.dll"
+`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") ImageLoaded = "*\\taskschd.dll"
| stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
@@ -24327,7 +25506,7 @@ this detection was designed to identifies suspicious office documents that using
====Search====
-
`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "wordpad.exe") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL")
+`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL")
| stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name ProcessId ProcessGuid
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
@@ -24337,6 +25516,8 @@ this detection was designed to identifies suspicious office documents that using
* [[Documentation:ESSOC:stories:UseCase#Spearphishing_Attachments|Spearphishing Attachments]]
+* [[Documentation:ESSOC:stories:UseCase#Trickbot|Trickbot]]
+
====How To Implement====
To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Also be sure to include those monitored dll to your own sysmon config.
@@ -24413,7 +25594,7 @@ this search is to detect potential malicious office document executing lolbin ch
====Search====
-`sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe", "excel.exe", "visio.exe", "wordpad.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*") NOT(OriginalFileName IN("*\\firefox.exe", "*\\chrome.exe","*\\iexplore.exe","*\\msedge.exe"))
+`sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe", "excel.exe", "visio.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*") NOT(OriginalFileName IN("*\\firefox.exe", "*\\chrome.exe","*\\iexplore.exe","*\\msedge.exe"))
| stats min(_time) as firstTime max(_time) as lastTime count by parent_process_name process_name parent_process cmdline process_id OriginalFileName ProcessGuid Computer EventCode
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
@@ -25066,6 +26247,96 @@ Limited false positives. It is possible administrators will utilize Start-BitsTr
* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log
+''version'': 1
+
+
+
+
+====Search====
+`sysmon` EventCode = 8 process_name IN ("powershell_ise.exe", "powershell.exe") TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe")
+| stats min(_time) as firstTime max(_time) as lastTime count by SourceImage process_name SourceProcessId SourceProcessGuid TargetImage TargetProcessId NewThreadId StartAddress Computer EventCode
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `powershell_remote_thread_to_known_windows_process_filter`
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Trickbot|Trickbot]]
+
+
+====How To Implement====
+To successfully implement this search, you need to be ingesting logs with the process name, Create Remote thread from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of create remote thread may be used.
+
+====Required field====
+
+* _time
+
+* SourceImage
+
+* process_name
+
+* SourceProcessId
+
+* SourceProcessGuid
+
+* TargetImage
+
+* TargetProcessId
+
+* NewThreadId
+
+* StartAddress
+
+* Computer
+
+* EventCode
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1055
+| Process Injection
+| Defense Evasion, Privilege Escalation
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+unknown
+
+====Reference====
+
+
+* https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log
+
+
''version'': 1
+
+
+====Search====
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=slui.exe (Processes.process=*-verb* Processes.process=*runas*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+| `drop_dm_object_name(Processes)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `slui_runas_elevated_filter`
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]]
+
+* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]]
+
+
+====How To Implement====
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+
+====Required field====
+
+* _time
+
+* Processes.dest
+
+* Processes.user
+
+* Processes.parent_process
+
+* Processes.process_name
+
+* Processes.process
+
+* Processes.process_id
+
+* Processes.parent_process_id
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1548.002
+| Bypass User Account Control
+| Defense Evasion, Privilege Escalation
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+Limited false positives should be present as this is not commonly used by legitimate applications.
+
+====Reference====
+
+
+* https://www.exploit-db.com/exploits/46998
+
+* https://medium.com/@mattharr0ey/privilege-escalation-uac-bypass-in-changepk-c40b92818d1b
+
+* https://gist.github.com/r00t-3xp10it/0c92cd554d3156fd74f6c25660ccc466
+
+* https://www.rapid7.com/db/modules/exploit/windows/local/bypassuac_sluihijack/
+
+* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/slui/windows-sysmon.log
+
+
+''version'': 1
+
+
+
+
+====Search====
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=slui.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+| `drop_dm_object_name(Processes)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `slui_spawning_a_process_filter`
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]]
+
+* [[Documentation:ESSOC:stories:UseCase#Windows_Defense_Evasion_Tactics|Windows Defense Evasion Tactics]]
+
+
+====How To Implement====
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+
+====Required field====
+
+* _time
+
+* Processes.dest
+
+* Processes.user
+
+* Processes.parent_process
+
+* Processes.process_name
+
+* Processes.process
+
+* Processes.process_id
+
+* Processes.parent_process_id
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1548.002
+| Bypass User Account Control
+| Defense Evasion, Privilege Escalation
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+Certain applications may spawn from `slui.exe` that are legitimate. Filtering will be needed to ensure proper monitoring.
+
+====Reference====
+
+
+* https://www.exploit-db.com/exploits/46998
+
+* https://www.rapid7.com/db/modules/exploit/windows/local/bypassuac_sluihijack/
+
+* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/slui/windows-sysmon.log
+
+
''version'': 1
+
+
+====Search====
+`wineventlog_security` EventCode=4698
+| xmlkv Message
+| search Arguments IN ("*http*")
+| stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden, Arguments
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `schedule_task_with_http_command_arguments_filter`
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Windows_Persistence_Techniques|Windows Persistence Techniques]]
+
+
+====How To Implement====
+To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment.
+
+====Required field====
+
+* _time
+
+* dest
+
+* Task_Name
+
+* Command
+
+* Author
+
+* Enabled
+
+* Hidden
+
+* Arguments
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1053
+| Scheduled Task/Job
+| Execution, Persistence, Privilege Escalation
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+unknown
+
+====Reference====
+
+
+* https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/tasksched/windows-security.log
+
+
+''version'': 1
+
+
+
+
+====Search====
+`wineventlog_security` EventCode=4698
+| xmlkv Message
+| search Command IN ("*rundll32*")
+| stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden, Arguments
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `schedule_task_with_rundll32_command_trigger_filter`
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Windows_Persistence_Techniques|Windows Persistence Techniques]]
+
+* [[Documentation:ESSOC:stories:UseCase#Trickbot|Trickbot]]
+
+
+====How To Implement====
+To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment.
+
+====Required field====
+
+* _time
+
+* dest
+
+* Task_Name
+
+* Command
+
+* Author
+
+* Enabled
+
+* Hidden
+
+* Arguments
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1053
+| Scheduled Task/Job
+| Execution, Persistence, Privilege Escalation
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+unknown
+
+====Reference====
+
+
+* https://labs.vipre.com/trickbot-and-its-modules/
+
+* https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/tasksched/windows-security.log
+
+
+''version'': 1
+
+
-
-
-====Search====
-`wineventlog_security` EventCode=4698
-| xmlkv Message
-| search Arguments IN ("*http*")
-| stats count min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author, Enabled, Hidden, Arguments
-| `security_content_ctime(firstTime)`
-| `security_content_ctime(lastTime)`
-| `shedule_task_with_http_command_arguments_filter`
-
-====Associated Analytic Story====
-
-* [[Documentation:ESSOC:stories:UseCase#Windows_Persistence_Techniques|Windows Persistence Techniques]]
-
-
-====How To Implement====
-To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment.
-
-====Required field====
-
-* _time
-
-* dest
-
-* Task_Name
-
-* Command
-
-* Author
-
-* Enabled
-
-* Hidden
-
-* Arguments
-
-
-
-====ATT&CK====
-{|
-! style="text-align:left;"| ID
-! Technique
-! Tactic
-|-
-| T1053
-| Scheduled Task/Job
-| Execution, Persistence, Privilege Escalation
-|}
-
-
-====Kill Chain Phase====
-
-* Exploitation
-
-
-====Known False Positives====
-unknown
-
-====Reference====
-
-
-* https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/
-
-
-
-====Test Dataset====
-
-* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/tasksched/windows-security.log
-
-
''version'': 1
+
+
+====Search====
+`sysmon` EventCode IN (17,18) PipeName="\\pipe\\*lacesomepipe"
+| stats min(_time) as firstTime max(_time) as lastTime count by Computer user_id EventCode PipeName signature Image process_id
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `trickbot_named_pipe_filter`
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Trickbot|Trickbot]]
+
+
+====How To Implement====
+To successfully implement this search, you need to be ingesting logs with the process name and pipename from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. .
+
+====Required field====
+
+* _time
+
+* Computer
+
+* user_id
+
+* EventCode
+
+* PipeName
+
+* signature
+
+* Image
+
+* process_id
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1055
+| Process Injection
+| Defense Evasion, Privilege Escalation
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+unknown
+
+====Reference====
+
+
+* https://labs.vipre.com/trickbot-and-its-modules/
+
+* https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/namedpipe/windows-sysmon.log
+
+
+''version'': 1
+
+
+
+
+====Search====
+`sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org","*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net")
+| stats min(_time) as firstTime max(_time) as lastTime count by process_path process_name process_id QueryName QueryStatus QueryResults Computer EventCode
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `wermgr_process_connecting_to_ip_check_web_services_filter`
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Trickbot|Trickbot]]
+
+
+====How To Implement====
+To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA.
+
+====Required field====
+
+* _time
+
+* process_path
+
+* process_name
+
+* process_id
+
+* QueryName
+
+* QueryStatus
+
+* QueryResults
+
+* Computer
+
+* EventCode
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1590.005
+| IP Addresses
+| Reconnaissance
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+unknown
+
+====Reference====
+
+
+* https://labs.vipre.com/trickbot-and-its-modules/
+
+* https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log
+
+
+''version'': 1
+
+
+
+
+====Search====
+`sysmon` EventCode=11 process_name = "wermgr.exe" TargetFilename = "*.exe"
+| stats min(_time) as firstTime max(_time) as lastTime count by Image TargetFilename process_name dest EventCode ProcessId
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `wermgr_process_create_executable_file_filter`
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Trickbot|Trickbot]]
+
+
+====How To Implement====
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+
+====Required field====
+
+* _time
+
+* Image
+
+* TargetFilename
+
+* process_name
+
+* dest
+
+* EventCode
+
+* ProcessId
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1027
+| Obfuscated Files or Information
+| Defense Evasion
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+unknown
+
+====Reference====
+
+
+* https://labs.vipre.com/trickbot-and-its-modules/
+
+* https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log
+
+
+''version'': 1
+
+
+
+
+====Search====
+
+| tstats `security_content_summariesonly` values(Processes.process) as cmdline min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name = "wermgr.exe" Processes.process_name = "cmd.exe" OR Processes.process_name = "powershell.exe" by Processes.parent_process_name Processes.parent_process_id Processes.process_name Processes.process Processes.process_id Processes.process_guid Processes.dest Processes.user
+| `drop_dm_object_name(Processes)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `wermgr_process_spawned_cmd_or_powershell_process_filter`
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Trickbot|Trickbot]]
+
+
+====How To Implement====
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+
+====Required field====
+
+* _time
+
+* Processes.parent_process_name
+
+* Processes.parent_process_id
+
+* Processes.process_name
+
+* Processes.process
+
+* Processes.process_id
+
+* Processes.process_guid
+
+* Processes.dest
+
+* Processes.user
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1059
+| Command and Scripting Interpreter
+| Execution
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+unknown
+
+====Reference====
+
+
+* https://labs.vipre.com/trickbot-and-its-modules/
+
+* https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log
+
+
''version'': 1
+
+
+====Search====
+`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll") Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask= "0x2"
+| stats min(_time) as firstTime max(_time) as lastTime count by EventCode Share_Name Relative_Target_Name Object_Type Access_Mask user src_port Source_Address
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `write_executable_in_smb_share_filter`
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#Trickbot|Trickbot]]
+
+
+====How To Implement====
+To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy.
+
+====Required field====
+
+* _time
+
+* EventCode
+
+* Share_Name
+
+* Relative_Target_Name
+
+* Object_Type
+
+* Access_Mask
+
+* user
+
+* src_port
+
+* Source_Address
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1021.002
+| SMB/Windows Admin Shares
+| Lateral Movement
+|}
+
+
+====Kill Chain Phase====
+
+* Lateral Movement
+
+
+====Known False Positives====
+unknown
+
+====Reference====
+
+
+* https://labs.vipre.com/trickbot-and-its-modules/
+
+* https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
+
+
+
+====Test Dataset====
+
+* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/exe_smbshare/windows-security.log
+
+
+''version'': 1
+
+
+
+
+====Search====
+`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*"
+| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `delete_shadowcopy_with_powershell_filter`
+
+====Associated Analytic Story====
+
+* [[Documentation:ESSOC:stories:UseCase#DarkSide_Ransomware|DarkSide Ransomware]]
+
+
+====How To Implement====
+To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event.
+
+====Required field====
+
+* _time
+
+* EventCode
+
+* Message
+
+* ComputerName
+
+* User
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1490
+| Inhibit System Recovery
+| Impact
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Known False Positives====
+unknown
+
+====Reference====
+
+
+* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+
+* https://searchwindowsserver.techtarget.com/tutorial/Set-up-PowerShell-script-block-logging-for-added-security
+
+
+
+====Test Dataset====
+
+
''version'': 1
#############
# Automatically generated by doc_gen.py in https://github.com/splunk/security_content''
-# On Date: 2021-04-29 21:24:36.954653 UTC''
+# On Date: 2021-05-13 22:00:21.859290 UTC''
# Author: Splunk Security Research''
# Contact: research@splunk.com''
#############
diff --git a/docs/mitre-map/coverage.csv b/docs/mitre-map/coverage.csv
index 49cada9d02..04d042aacf 100644
--- a/docs/mitre-map/coverage.csv
+++ b/docs/mitre-map/coverage.csv
@@ -47,17 +47,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -69,7 +69,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -89,9 +89,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -99,10 +101,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -145,7 +148,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -226,11 +229,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -279,22 +283,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -307,14 +313,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -338,7 +345,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -405,10 +412,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -416,7 +423,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -444,15 +458,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -461,7 +476,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -570,8 +586,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -623,8 +639,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -638,8 +654,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -694,7 +710,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -733,8 +750,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -945,10 +962,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -1027,17 +1045,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -1049,7 +1067,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -1069,9 +1087,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -1079,10 +1099,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -1125,7 +1146,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -1206,11 +1227,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -1259,22 +1281,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -1287,14 +1311,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -1318,7 +1343,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -1385,10 +1410,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -1396,7 +1421,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -1424,15 +1456,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -1441,7 +1474,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -1550,8 +1584,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -1603,8 +1637,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -1618,8 +1652,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -1674,7 +1708,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -1713,8 +1748,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -1925,10 +1960,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -2007,17 +2043,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -2029,7 +2065,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -2049,9 +2085,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -2059,10 +2097,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -2105,7 +2144,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -2186,11 +2225,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -2239,22 +2279,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -2267,14 +2309,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -2298,7 +2341,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -2365,10 +2408,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -2376,7 +2419,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -2404,15 +2454,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -2421,7 +2472,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -2530,8 +2582,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -2583,8 +2635,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -2598,8 +2650,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -2654,7 +2706,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -2693,8 +2746,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -2905,10 +2958,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -2987,17 +3041,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -3009,7 +3063,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -3029,9 +3083,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -3039,10 +3095,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -3085,7 +3142,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -3166,11 +3223,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -3219,22 +3277,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -3247,14 +3307,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -3278,7 +3339,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -3345,10 +3406,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -3356,7 +3417,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -3384,15 +3452,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -3401,7 +3470,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -3510,8 +3580,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -3563,8 +3633,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -3578,8 +3648,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -3634,7 +3704,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -3673,8 +3744,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -3885,10 +3956,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -3967,17 +4039,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -3989,7 +4061,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -4009,9 +4081,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -4019,10 +4093,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -4065,7 +4140,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -4146,11 +4221,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -4199,22 +4275,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -4227,14 +4305,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -4258,7 +4337,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -4325,10 +4404,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -4336,7 +4415,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -4364,15 +4450,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -4381,7 +4468,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -4490,8 +4578,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -4543,8 +4631,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -4558,8 +4646,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -4614,7 +4702,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -4653,8 +4742,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -4865,10 +4954,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -4947,17 +5037,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -4969,7 +5059,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -4989,9 +5079,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -4999,10 +5091,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -5045,7 +5138,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -5126,11 +5219,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -5179,22 +5273,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -5207,14 +5303,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -5238,7 +5335,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -5305,10 +5402,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -5316,7 +5413,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -5344,15 +5448,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -5361,7 +5466,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -5470,8 +5576,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -5523,8 +5629,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -5538,8 +5644,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -5594,7 +5700,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -5633,8 +5740,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -5845,10 +5952,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -5927,17 +6035,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -5949,7 +6057,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -5969,9 +6077,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -5979,10 +6089,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -6025,7 +6136,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -6106,11 +6217,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -6159,22 +6271,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -6187,14 +6301,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -6218,7 +6333,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -6285,10 +6400,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -6296,7 +6411,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -6324,15 +6446,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -6341,7 +6464,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -6450,8 +6574,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -6503,8 +6627,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -6518,8 +6642,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -6574,7 +6698,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -6613,8 +6738,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -6825,10 +6950,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -6907,17 +7033,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -6929,7 +7055,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -6949,9 +7075,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -6959,10 +7087,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -7005,7 +7134,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -7086,11 +7215,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -7139,22 +7269,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -7167,14 +7299,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -7198,7 +7331,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -7265,10 +7398,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -7276,7 +7409,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -7304,15 +7444,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -7321,7 +7462,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -7430,8 +7572,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -7483,8 +7625,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -7498,8 +7640,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -7554,7 +7696,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -7593,8 +7736,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -7805,10 +7948,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -7887,17 +8031,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -7909,7 +8053,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -7929,9 +8073,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -7939,10 +8085,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -7985,7 +8132,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -8066,11 +8213,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -8119,22 +8267,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -8147,14 +8297,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -8178,7 +8329,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -8245,10 +8396,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -8256,7 +8407,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -8284,15 +8442,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -8301,7 +8460,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -8410,8 +8570,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -8463,8 +8623,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -8478,8 +8638,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -8534,7 +8694,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -8573,8 +8734,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -8785,10 +8946,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -8867,17 +9029,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -8889,7 +9051,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -8909,9 +9071,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -8919,10 +9083,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -8965,7 +9130,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -9046,11 +9211,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -9099,22 +9265,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -9127,14 +9295,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -9158,7 +9327,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -9225,10 +9394,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -9236,7 +9405,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -9264,15 +9440,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -9281,7 +9458,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -9390,8 +9568,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -9443,8 +9621,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -9458,8 +9636,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -9514,7 +9692,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -9553,8 +9732,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -9765,10 +9944,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -9847,17 +10027,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -9869,7 +10049,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -9889,9 +10069,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -9899,10 +10081,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -9945,7 +10128,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -10026,11 +10209,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -10079,22 +10263,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -10107,14 +10293,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -10138,7 +10325,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -10205,10 +10392,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -10216,7 +10403,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -10244,15 +10438,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -10261,7 +10456,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -10370,8 +10566,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -10423,8 +10619,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -10438,8 +10634,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -10494,7 +10690,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -10533,8 +10730,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -10745,10 +10942,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -10827,17 +11025,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -10849,7 +11047,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -10869,9 +11067,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -10879,10 +11079,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -10925,7 +11126,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -11006,11 +11207,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -11059,22 +11261,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -11087,14 +11291,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -11118,7 +11323,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -11185,10 +11390,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -11196,7 +11401,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -11224,15 +11436,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -11241,7 +11454,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -11350,8 +11564,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -11403,8 +11617,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -11418,8 +11632,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -11474,7 +11688,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -11513,8 +11728,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -11725,10 +11940,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -11807,17 +12023,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -11829,7 +12045,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -11849,9 +12065,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -11859,10 +12077,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -11905,7 +12124,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -11986,11 +12205,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -12039,22 +12259,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -12067,14 +12289,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -12098,7 +12321,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -12165,10 +12388,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -12176,7 +12399,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -12204,15 +12434,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -12221,7 +12452,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -12330,8 +12562,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -12383,8 +12615,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -12398,8 +12630,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -12454,7 +12686,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -12493,8 +12726,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -12705,10 +12938,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -12787,17 +13021,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -12809,7 +13043,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -12829,9 +13063,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -12839,10 +13075,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -12885,7 +13122,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -12966,11 +13203,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -13019,22 +13257,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -13047,14 +13287,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -13078,7 +13319,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -13145,10 +13386,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -13156,7 +13397,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -13184,15 +13432,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -13201,7 +13450,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -13310,8 +13560,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -13363,8 +13613,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -13378,8 +13628,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -13434,7 +13684,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -13473,8 +13724,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -13685,10 +13936,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -13767,17 +14019,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -13789,7 +14041,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -13809,9 +14061,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -13819,10 +14073,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -13865,7 +14120,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -13946,11 +14201,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -13999,22 +14255,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -14027,14 +14285,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -14058,7 +14317,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -14125,10 +14384,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -14136,7 +14395,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -14164,15 +14430,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -14181,7 +14448,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -14290,8 +14558,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -14343,8 +14611,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -14358,8 +14626,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -14414,7 +14682,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -14453,8 +14722,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -14665,10 +14934,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -14747,17 +15017,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -14769,7 +15039,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -14789,9 +15059,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -14799,10 +15071,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -14845,7 +15118,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -14926,11 +15199,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -14979,22 +15253,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -15007,14 +15283,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -15038,7 +15315,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -15105,10 +15382,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -15116,7 +15393,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -15144,15 +15428,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -15161,7 +15446,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -15270,8 +15556,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -15323,8 +15609,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -15338,8 +15624,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -15394,7 +15680,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -15433,8 +15720,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -15645,10 +15932,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -15727,17 +16015,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -15749,7 +16037,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -15769,9 +16057,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -15779,10 +16069,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -15825,7 +16116,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -15906,11 +16197,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -15959,22 +16251,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -15987,14 +16281,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -16018,7 +16313,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -16085,10 +16380,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -16096,7 +16391,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -16124,15 +16426,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -16141,7 +16444,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -16250,8 +16554,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -16303,8 +16607,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -16318,8 +16622,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -16374,7 +16678,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -16413,8 +16718,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -16625,10 +16930,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -16707,17 +17013,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -16729,7 +17035,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -16749,9 +17055,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -16759,10 +17067,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -16805,7 +17114,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -16886,11 +17195,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -16939,22 +17249,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -16967,14 +17279,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -16998,7 +17311,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -17065,10 +17378,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -17076,7 +17389,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -17104,15 +17424,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -17121,7 +17442,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -17230,8 +17552,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -17283,8 +17605,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -17298,8 +17620,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -17354,7 +17676,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -17393,8 +17716,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -17605,10 +17928,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -17687,17 +18011,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -17709,7 +18033,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -17729,9 +18053,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -17739,10 +18065,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -17785,7 +18112,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -17866,11 +18193,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -17919,22 +18247,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -17947,14 +18277,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -17978,7 +18309,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -18045,10 +18376,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -18056,7 +18387,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -18084,15 +18422,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -18101,7 +18440,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -18210,8 +18550,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -18263,8 +18603,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -18278,8 +18618,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -18334,7 +18674,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -18373,8 +18714,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -18585,10 +18926,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -18667,17 +19009,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -18689,7 +19031,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -18709,9 +19051,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -18719,10 +19063,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -18765,7 +19110,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -18846,11 +19191,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -18899,22 +19245,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -18927,14 +19275,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -18958,7 +19307,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -19025,10 +19374,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -19036,7 +19385,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -19064,15 +19420,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -19081,7 +19438,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -19190,8 +19548,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -19243,8 +19601,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -19258,8 +19616,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -19314,7 +19672,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -19353,8 +19712,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -19565,10 +19924,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -19647,17 +20007,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -19669,7 +20029,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -19689,9 +20049,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -19699,10 +20061,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -19745,7 +20108,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -19826,11 +20189,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -19879,22 +20243,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -19907,14 +20273,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -19938,7 +20305,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -20005,10 +20372,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -20016,7 +20383,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -20044,15 +20418,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -20061,7 +20436,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -20170,8 +20546,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -20223,8 +20599,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -20238,8 +20614,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -20294,7 +20670,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -20333,8 +20710,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -20545,10 +20922,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -20627,17 +21005,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -20649,7 +21027,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -20669,9 +21047,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -20679,10 +21059,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -20725,7 +21106,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -20806,11 +21187,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -20859,22 +21241,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -20887,14 +21271,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -20918,7 +21303,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -20985,10 +21370,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -20996,7 +21381,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -21024,15 +21416,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -21041,7 +21434,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -21150,8 +21544,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -21203,8 +21597,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -21218,8 +21612,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -21274,7 +21668,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -21313,8 +21708,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -21525,10 +21920,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -21607,17 +22003,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -21629,7 +22025,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -21649,9 +22045,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -21659,10 +22057,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -21705,7 +22104,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -21786,11 +22185,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -21839,22 +22239,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -21867,14 +22269,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -21898,7 +22301,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -21965,10 +22368,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -21976,7 +22379,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -22004,15 +22414,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -22021,7 +22432,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -22130,8 +22542,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -22183,8 +22595,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -22198,8 +22610,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -22254,7 +22666,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -22293,8 +22706,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -22505,10 +22918,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -22587,17 +23001,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -22609,7 +23023,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -22629,9 +23043,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -22639,10 +23055,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -22685,7 +23102,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -22766,11 +23183,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -22819,22 +23237,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -22847,14 +23267,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -22878,7 +23299,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -22945,10 +23366,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -22956,7 +23377,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -22984,15 +23412,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -23001,7 +23430,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -23110,8 +23540,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -23163,8 +23593,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -23178,8 +23608,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -23234,7 +23664,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -23273,8 +23704,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -23485,10 +23916,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -23567,17 +23999,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -23589,7 +24021,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -23609,9 +24041,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -23619,10 +24053,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -23665,7 +24100,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -23746,11 +24181,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -23799,22 +24235,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -23827,14 +24265,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -23858,7 +24297,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -23925,10 +24364,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -23936,7 +24375,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -23964,15 +24410,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -23981,7 +24428,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -24090,8 +24538,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -24143,8 +24591,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -24158,8 +24606,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -24214,7 +24662,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -24253,8 +24702,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -24465,10 +24914,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -24547,17 +24997,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -24569,7 +25019,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -24589,9 +25039,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -24599,10 +25051,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -24645,7 +25098,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -24726,11 +25179,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -24779,22 +25233,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -24807,14 +25263,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -24838,7 +25295,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -24905,10 +25362,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -24916,7 +25373,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -24944,15 +25408,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -24961,7 +25426,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -25070,8 +25536,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -25123,8 +25589,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -25138,8 +25604,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -25194,7 +25660,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -25233,8 +25700,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -25445,10 +25912,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -25527,17 +25995,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -25549,7 +26017,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -25569,9 +26037,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -25579,10 +26049,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -25625,7 +26096,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -25706,11 +26177,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -25759,22 +26231,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -25787,14 +26261,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -25818,7 +26293,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -25885,10 +26360,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -25896,7 +26371,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -25924,15 +26406,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -25941,7 +26424,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -26050,8 +26534,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -26103,8 +26587,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -26118,8 +26602,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -26174,7 +26658,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -26213,8 +26698,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -26425,10 +26910,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -26507,17 +26993,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -26529,7 +27015,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -26549,9 +27035,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -26559,10 +27047,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -26605,7 +27094,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -26686,11 +27175,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -26739,22 +27229,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -26767,14 +27259,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -26798,7 +27291,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -26865,10 +27358,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -26876,7 +27369,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -26904,15 +27404,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -26921,7 +27422,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -27030,8 +27532,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -27083,8 +27585,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -27098,8 +27600,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -27154,7 +27656,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -27193,8 +27696,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -27405,10 +27908,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -27487,17 +27991,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -27509,7 +28013,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -27529,9 +28033,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -27539,10 +28045,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -27585,7 +28092,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -27666,11 +28173,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -27719,22 +28227,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -27747,14 +28257,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -27778,7 +28289,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -27845,10 +28356,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -27856,7 +28367,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -27884,15 +28402,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -27901,7 +28420,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -28010,8 +28530,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -28063,8 +28583,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -28078,8 +28598,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -28134,7 +28654,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -28173,8 +28694,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -28385,10 +28906,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -28467,17 +28989,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -28489,7 +29011,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -28509,9 +29031,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -28519,10 +29043,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -28565,7 +29090,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -28646,11 +29171,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -28699,22 +29225,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -28727,14 +29255,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -28758,7 +29287,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -28825,10 +29354,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -28836,7 +29365,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -28864,15 +29400,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -28881,7 +29418,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -28990,8 +29528,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -29043,8 +29581,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -29058,8 +29596,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -29114,7 +29652,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -29153,8 +29692,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -29365,10 +29904,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -29447,17 +29987,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -29469,7 +30009,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -29489,9 +30029,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -29499,10 +30041,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -29545,7 +30088,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -29626,11 +30169,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -29679,22 +30223,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -29707,14 +30253,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -29738,7 +30285,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -29805,10 +30352,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -29816,7 +30363,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -29844,15 +30398,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -29861,7 +30416,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -29970,8 +30526,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -30023,8 +30579,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -30038,8 +30594,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -30094,7 +30650,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -30133,8 +30690,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -30345,10 +30902,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -30427,17 +30985,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -30449,7 +31007,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -30469,9 +31027,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -30479,10 +31039,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -30525,7 +31086,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -30606,11 +31167,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -30659,22 +31221,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -30687,14 +31251,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -30718,7 +31283,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -30785,10 +31350,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -30796,7 +31361,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -30824,15 +31396,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -30841,7 +31414,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -30950,8 +31524,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -31003,8 +31577,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -31018,8 +31592,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -31074,7 +31648,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -31113,8 +31688,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -31325,10 +31900,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -31407,17 +31983,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -31429,7 +32005,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -31449,9 +32025,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -31459,10 +32037,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -31505,7 +32084,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -31586,11 +32165,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -31639,22 +32219,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -31667,14 +32249,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -31698,7 +32281,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -31765,10 +32348,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -31776,7 +32359,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -31804,15 +32394,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -31821,7 +32412,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -31930,8 +32522,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -31983,8 +32575,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -31998,8 +32590,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -32054,7 +32646,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -32093,8 +32686,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -32305,10 +32898,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -32387,17 +32981,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -32409,7 +33003,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -32429,9 +33023,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -32439,10 +33035,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -32485,7 +33082,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -32566,11 +33163,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -32619,22 +33217,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -32647,14 +33247,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -32678,7 +33279,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -32745,10 +33346,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -32756,7 +33357,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -32784,15 +33392,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -32801,7 +33410,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -32910,8 +33520,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -32963,8 +33573,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -32978,8 +33588,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -33034,7 +33644,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -33073,8 +33684,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -33285,10 +33896,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -33367,17 +33979,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -33389,7 +34001,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -33409,9 +34021,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -33419,10 +34033,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -33465,7 +34080,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -33546,11 +34161,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -33599,22 +34215,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -33627,14 +34245,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -33658,7 +34277,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -33725,10 +34344,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -33736,7 +34355,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -33764,15 +34390,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -33781,7 +34408,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -33890,8 +34518,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -33943,8 +34571,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -33958,8 +34586,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -34014,7 +34642,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -34053,8 +34682,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -34265,10 +34894,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -34347,17 +34977,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -34369,7 +34999,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -34389,9 +35019,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -34399,10 +35031,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -34445,7 +35078,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -34526,11 +35159,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -34579,22 +35213,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -34607,14 +35243,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -34638,7 +35275,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -34705,10 +35342,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -34716,7 +35353,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -34744,15 +35388,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -34761,7 +35406,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -34870,8 +35516,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -34923,8 +35569,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -34938,8 +35584,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -34994,7 +35640,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -35033,8 +35680,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -35245,10 +35892,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -35327,17 +35975,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -35349,7 +35997,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -35369,9 +36017,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -35379,10 +36029,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -35425,7 +36076,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -35506,11 +36157,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -35559,22 +36211,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -35587,14 +36241,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -35618,7 +36273,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -35685,10 +36340,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -35696,7 +36351,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -35724,15 +36386,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -35741,7 +36404,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -35850,8 +36514,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -35903,8 +36567,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -35918,8 +36582,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -35974,7 +36638,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -36013,8 +36678,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -36225,10 +36890,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -36307,17 +36973,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -36329,7 +36995,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -36349,9 +37015,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -36359,10 +37027,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -36405,7 +37074,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -36486,11 +37155,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -36539,22 +37209,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -36567,14 +37239,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -36598,7 +37271,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -36665,10 +37338,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -36676,7 +37349,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -36704,15 +37384,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -36721,7 +37402,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -36830,8 +37512,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -36883,8 +37565,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -36898,8 +37580,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -36954,7 +37636,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -36993,8 +37676,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -37205,10 +37888,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -37287,17 +37971,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -37309,7 +37993,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -37329,9 +38013,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -37339,10 +38025,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -37385,7 +38072,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -37466,11 +38153,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -37519,22 +38207,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -37547,14 +38237,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -37578,7 +38269,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -37645,10 +38336,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -37656,7 +38347,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -37684,15 +38382,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -37701,7 +38400,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -37810,8 +38510,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -37863,8 +38563,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -37878,8 +38578,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -37934,7 +38634,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -37973,8 +38674,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -38185,10 +38886,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -38267,17 +38969,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -38289,7 +38991,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -38309,9 +39011,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -38319,10 +39023,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -38365,7 +39070,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -38446,11 +39151,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -38499,22 +39205,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -38527,14 +39235,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -38558,7 +39267,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -38625,10 +39334,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -38636,7 +39345,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -38664,15 +39380,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -38681,7 +39398,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -38790,8 +39508,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -38843,8 +39561,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -38858,8 +39576,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -38914,7 +39632,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -38953,8 +39672,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -39165,10 +39884,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -39247,17 +39967,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -39269,7 +39989,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -39289,9 +40009,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -39299,10 +40021,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -39345,7 +40068,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -39426,11 +40149,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -39479,22 +40203,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -39507,14 +40233,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -39538,7 +40265,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -39605,10 +40332,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -39616,7 +40343,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -39644,15 +40378,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -39661,7 +40396,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -39770,8 +40506,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -39823,8 +40559,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -39838,8 +40574,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -39894,7 +40630,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -39933,8 +40670,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -40145,10 +40882,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -40227,17 +40965,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -40249,7 +40987,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -40269,9 +41007,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -40279,10 +41019,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -40325,7 +41066,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -40406,11 +41147,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -40459,22 +41201,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -40487,14 +41231,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -40518,7 +41263,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -40585,10 +41330,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -40596,7 +41341,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -40624,15 +41376,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -40641,7 +41394,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -40750,8 +41504,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -40803,8 +41557,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -40818,8 +41572,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -40874,7 +41628,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -40913,8 +41668,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -41125,10 +41880,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -41207,17 +41963,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -41229,7 +41985,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -41249,9 +42005,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -41259,10 +42017,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -41305,7 +42064,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -41386,11 +42145,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -41439,22 +42199,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -41467,14 +42229,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -41498,7 +42261,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -41565,10 +42328,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -41576,7 +42339,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -41604,15 +42374,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -41621,7 +42392,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -41730,8 +42502,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -41783,8 +42555,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -41798,8 +42570,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -41854,7 +42626,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -41893,8 +42666,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -42105,10 +42878,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -42187,17 +42961,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -42209,7 +42983,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -42229,9 +43003,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -42239,10 +43015,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -42285,7 +43062,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -42366,11 +43143,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -42419,22 +43197,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -42447,14 +43227,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -42478,7 +43259,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -42545,10 +43326,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -42556,7 +43337,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -42584,15 +43372,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -42601,7 +43390,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -42710,8 +43500,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -42763,8 +43553,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -42778,8 +43568,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -42834,7 +43624,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -42873,8 +43664,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -43085,10 +43876,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -43167,17 +43959,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -43189,7 +43981,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -43209,9 +44001,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -43219,10 +44013,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -43265,7 +44060,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -43346,11 +44141,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -43399,22 +44195,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -43427,14 +44225,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -43458,7 +44257,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -43525,10 +44324,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -43536,7 +44335,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -43564,15 +44370,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -43581,7 +44388,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -43690,8 +44498,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -43743,8 +44551,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -43758,8 +44566,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -43814,7 +44622,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -43853,8 +44662,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -44065,10 +44874,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -44147,17 +44957,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -44169,7 +44979,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -44189,9 +44999,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -44199,10 +45011,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -44245,7 +45058,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -44326,11 +45139,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -44379,22 +45193,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -44407,14 +45223,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -44438,7 +45255,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -44505,10 +45322,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -44516,7 +45333,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -44544,15 +45368,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -44561,7 +45386,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -44670,8 +45496,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -44723,8 +45549,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -44738,8 +45564,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -44794,7 +45620,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -44833,8 +45660,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -45045,10 +45872,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -45127,17 +45955,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -45149,7 +45977,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -45169,9 +45997,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -45179,10 +46009,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -45225,7 +46056,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -45306,11 +46137,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -45359,22 +46191,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -45387,14 +46221,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -45418,7 +46253,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -45485,10 +46320,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -45496,7 +46331,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -45524,15 +46366,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -45541,7 +46384,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -45650,8 +46494,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -45703,8 +46547,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -45718,8 +46562,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -45774,7 +46618,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -45813,8 +46658,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -46025,10 +46870,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -46107,17 +46953,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -46129,7 +46975,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -46149,9 +46995,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -46159,10 +47007,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -46205,7 +47054,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -46286,11 +47135,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -46339,22 +47189,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -46367,14 +47219,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -46398,7 +47251,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -46465,10 +47318,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -46476,7 +47329,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -46504,15 +47364,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -46521,7 +47382,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -46630,8 +47492,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -46683,8 +47545,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -46698,8 +47560,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -46754,7 +47616,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -46793,8 +47656,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -47005,10 +47868,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -47087,17 +47951,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -47109,7 +47973,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -47129,9 +47993,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -47139,10 +48005,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -47185,7 +48052,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -47266,11 +48133,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -47319,22 +48187,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -47347,14 +48217,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -47378,7 +48249,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -47445,10 +48316,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -47456,7 +48327,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -47484,15 +48362,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -47501,7 +48380,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -47610,8 +48490,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -47663,8 +48543,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -47678,8 +48558,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -47734,7 +48614,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -47773,8 +48654,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -47985,10 +48866,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -48067,17 +48949,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -48089,7 +48971,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -48109,9 +48991,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -48119,10 +49003,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -48165,7 +49050,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -48246,11 +49131,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -48299,22 +49185,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -48327,14 +49215,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -48358,7 +49247,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -48425,10 +49314,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -48436,7 +49325,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -48464,15 +49360,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -48481,7 +49378,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -48590,8 +49488,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -48643,8 +49541,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -48658,8 +49556,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -48714,7 +49612,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -48753,8 +49652,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -48965,10 +49864,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -49047,17 +49947,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -49069,7 +49969,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -49089,9 +49989,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -49099,10 +50001,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -49145,7 +50048,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -49226,11 +50129,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -49279,22 +50183,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -49307,14 +50213,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -49338,7 +50245,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -49405,10 +50312,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -49416,7 +50323,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -49444,15 +50358,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -49461,7 +50376,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -49570,8 +50486,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -49623,8 +50539,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -49638,8 +50554,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -49694,7 +50610,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -49733,8 +50650,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -49945,10 +50862,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -50027,17 +50945,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -50049,7 +50967,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -50069,9 +50987,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -50079,10 +50999,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -50125,7 +51046,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -50206,11 +51127,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -50259,22 +51181,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -50287,14 +51211,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -50318,7 +51243,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -50385,10 +51310,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -50396,7 +51321,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -50424,15 +51356,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -50441,7 +51374,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -50550,8 +51484,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -50603,8 +51537,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -50618,8 +51552,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -50674,7 +51608,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -50713,8 +51648,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -50925,10 +51860,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -51007,17 +51943,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -51029,7 +51965,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -51049,9 +51985,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -51059,10 +51997,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -51105,7 +52044,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -51186,11 +52125,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -51239,22 +52179,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -51267,14 +52209,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -51298,7 +52241,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -51365,10 +52308,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -51376,7 +52319,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -51404,15 +52354,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -51421,7 +52372,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -51530,8 +52482,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -51583,8 +52535,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -51598,8 +52550,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -51654,7 +52606,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -51693,8 +52646,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -51905,10 +52858,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -51987,17 +52941,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -52009,7 +52963,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -52029,9 +52983,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -52039,10 +52995,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -52085,7 +53042,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -52166,11 +53123,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -52219,22 +53177,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -52247,14 +53207,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -52278,7 +53239,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -52345,10 +53306,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -52356,7 +53317,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -52384,15 +53352,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -52401,7 +53370,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -52510,8 +53480,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -52563,8 +53533,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -52578,8 +53548,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -52634,7 +53604,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -52673,8 +53644,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -52885,10 +53856,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -52967,17 +53939,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -52989,7 +53961,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -53009,9 +53981,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -53019,10 +53993,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -53065,7 +54040,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -53146,11 +54121,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -53199,22 +54175,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -53227,14 +54205,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -53258,7 +54237,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -53325,10 +54304,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -53336,7 +54315,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -53364,15 +54350,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -53381,7 +54368,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -53490,8 +54478,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -53543,8 +54531,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -53558,8 +54546,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -53614,7 +54602,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -53653,8 +54642,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -53865,10 +54854,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -53947,17 +54937,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -53969,7 +54959,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -53989,9 +54979,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -53999,10 +54991,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -54045,7 +55038,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -54126,11 +55119,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -54179,22 +55173,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -54207,14 +55203,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -54238,7 +55235,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -54305,10 +55302,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -54316,7 +55313,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -54344,15 +55348,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -54361,7 +55366,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -54470,8 +55476,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -54523,8 +55529,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -54538,8 +55544,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -54594,7 +55600,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -54633,8 +55640,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -54845,10 +55852,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -54927,17 +55935,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -54949,7 +55957,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -54969,9 +55977,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -54979,10 +55989,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -55025,7 +56036,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -55106,11 +56117,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -55159,22 +56171,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -55187,14 +56201,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -55218,7 +56233,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -55285,10 +56300,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -55296,7 +56311,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -55324,15 +56346,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -55341,7 +56364,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -55450,8 +56474,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -55503,8 +56527,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -55518,8 +56542,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -55574,7 +56598,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -55613,8 +56638,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -55825,10 +56850,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -55907,17 +56933,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -55929,7 +56955,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -55949,9 +56975,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -55959,10 +56987,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -56005,7 +57034,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -56086,11 +57115,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -56139,22 +57169,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -56167,14 +57199,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -56198,7 +57231,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -56265,10 +57298,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -56276,7 +57309,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -56304,15 +57344,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -56321,7 +57362,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -56430,8 +57472,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -56483,8 +57525,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -56498,8 +57540,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -56554,7 +57596,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -56593,8 +57636,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -56805,10 +57848,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -56887,17 +57931,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -56909,7 +57953,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -56929,9 +57973,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -56939,10 +57985,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -56985,7 +58032,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -57066,11 +58113,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -57119,22 +58167,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -57147,14 +58197,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -57178,7 +58229,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -57245,10 +58296,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -57256,7 +58307,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -57284,15 +58342,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -57301,7 +58360,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -57410,8 +58470,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -57463,8 +58523,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -57478,8 +58538,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -57534,7 +58594,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -57573,8 +58634,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -57785,10 +58846,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -57867,17 +58929,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -57889,7 +58951,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -57909,9 +58971,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -57919,10 +58983,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -57965,7 +59030,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -58046,11 +59111,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -58099,22 +59165,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -58127,14 +59195,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -58158,7 +59227,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -58225,10 +59294,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -58236,7 +59305,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -58264,15 +59340,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -58281,7 +59358,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -58390,8 +59468,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -58443,8 +59521,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -58458,8 +59536,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -58514,7 +59592,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -58553,8 +59632,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -58765,10 +59844,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -58847,17 +59927,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -58869,7 +59949,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -58889,9 +59969,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -58899,10 +59981,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -58945,7 +60028,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -59026,11 +60109,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -59079,22 +60163,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -59107,14 +60193,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -59138,7 +60225,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -59205,10 +60292,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -59216,7 +60303,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -59244,15 +60338,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -59261,7 +60356,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -59370,8 +60466,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -59423,8 +60519,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -59438,8 +60534,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -59494,7 +60590,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -59533,8 +60630,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -59745,10 +60842,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -59827,17 +60925,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -59849,7 +60947,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -59869,9 +60967,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -59879,10 +60979,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -59925,7 +61026,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -60006,11 +61107,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -60059,22 +61161,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -60087,14 +61191,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -60118,7 +61223,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -60185,10 +61290,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -60196,7 +61301,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -60224,15 +61336,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -60241,7 +61354,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -60350,8 +61464,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -60403,8 +61517,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -60418,8 +61532,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -60474,7 +61588,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -60513,8 +61628,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -60725,10 +61840,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -60807,17 +61923,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -60829,7 +61945,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -60849,9 +61965,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -60859,10 +61977,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -60905,7 +62024,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -60986,11 +62105,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -61039,22 +62159,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -61067,14 +62189,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -61098,7 +62221,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -61165,10 +62288,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -61176,7 +62299,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -61204,15 +62334,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -61221,7 +62352,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -61330,8 +62462,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -61383,8 +62515,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -61398,8 +62530,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -61454,7 +62586,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -61493,8 +62626,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -61705,10 +62838,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -61787,17 +62921,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -61809,7 +62943,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -61829,9 +62963,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -61839,10 +62975,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -61885,7 +63022,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -61966,11 +63103,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -62019,22 +63157,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -62047,14 +63187,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -62078,7 +63219,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -62145,10 +63286,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -62156,7 +63297,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -62184,15 +63332,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -62201,7 +63350,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -62310,8 +63460,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -62363,8 +63513,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -62378,8 +63528,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -62434,7 +63584,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -62473,8 +63624,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -62685,10 +63836,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -62767,17 +63919,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -62789,7 +63941,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -62809,9 +63961,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -62819,10 +63973,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -62865,7 +64020,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -62946,11 +64101,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -62999,22 +64155,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -63027,14 +64185,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -63058,7 +64217,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -63125,10 +64284,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -63136,7 +64295,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -63164,15 +64330,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -63181,7 +64348,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -63290,8 +64458,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -63343,8 +64511,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -63358,8 +64526,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -63414,7 +64582,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -63453,8 +64622,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -63665,10 +64834,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -63747,17 +64917,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -63769,7 +64939,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -63789,9 +64959,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -63799,10 +64971,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -63845,7 +65018,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -63926,11 +65099,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -63979,22 +65153,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -64007,14 +65183,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -64038,7 +65215,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -64105,10 +65282,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -64116,7 +65293,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -64144,15 +65328,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -64161,7 +65346,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -64270,8 +65456,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -64323,8 +65509,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -64338,8 +65524,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -64394,7 +65580,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -64433,8 +65620,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -64645,10 +65832,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -64727,17 +65915,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -64749,7 +65937,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -64769,9 +65957,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -64779,10 +65969,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -64825,7 +66016,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -64906,11 +66097,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -64959,22 +66151,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -64987,14 +66181,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -65018,7 +66213,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -65085,10 +66280,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -65096,7 +66291,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -65124,15 +66326,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -65141,7 +66344,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -65250,8 +66454,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -65303,8 +66507,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -65318,8 +66522,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -65374,7 +66578,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -65413,8 +66618,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -65625,10 +66830,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -65707,17 +66913,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -65729,7 +66935,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -65749,9 +66955,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -65759,10 +66967,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -65805,7 +67014,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -65886,11 +67095,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -65939,22 +67149,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -65967,14 +67179,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -65998,7 +67211,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -66065,10 +67278,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -66076,7 +67289,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -66104,15 +67324,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -66121,7 +67342,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -66230,8 +67452,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -66283,8 +67505,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -66298,8 +67520,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -66354,7 +67576,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -66393,8 +67616,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -66605,10 +67828,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -66687,17 +67911,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -66709,7 +67933,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -66729,9 +67953,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -66739,10 +67965,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -66785,7 +68012,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -66866,11 +68093,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -66919,22 +68147,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -66947,14 +68177,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -66978,7 +68209,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -67045,10 +68276,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -67056,7 +68287,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -67084,15 +68322,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -67101,7 +68340,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -67210,8 +68450,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -67263,8 +68503,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -67278,8 +68518,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -67334,7 +68574,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -67373,8 +68614,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -67585,10 +68826,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -67667,17 +68909,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -67689,7 +68931,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -67709,9 +68951,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -67719,10 +68963,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -67765,7 +69010,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -67846,11 +69091,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -67899,22 +69145,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -67927,14 +69175,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -67958,7 +69207,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -68025,10 +69274,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -68036,7 +69285,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -68064,15 +69320,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -68081,7 +69338,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -68190,8 +69448,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -68243,8 +69501,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -68258,8 +69516,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -68314,7 +69572,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -68353,8 +69612,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -68565,10 +69824,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -68647,17 +69907,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -68669,7 +69929,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -68689,9 +69949,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -68699,10 +69961,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -68745,7 +70008,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -68826,11 +70089,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -68879,22 +70143,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -68907,14 +70173,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -68938,7 +70205,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -69005,10 +70272,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -69016,7 +70283,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -69044,15 +70318,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -69061,7 +70336,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -69170,8 +70446,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -69223,8 +70499,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -69238,8 +70514,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -69294,7 +70570,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -69333,8 +70610,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -69545,10 +70822,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -69627,17 +70905,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -69649,7 +70927,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -69669,9 +70947,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -69679,10 +70959,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -69725,7 +71006,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -69806,11 +71087,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -69859,22 +71141,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -69887,14 +71171,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -69918,7 +71203,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -69985,10 +71270,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -69996,7 +71281,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -70024,15 +71316,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -70041,7 +71334,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -70150,8 +71444,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -70203,8 +71497,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -70218,8 +71512,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -70274,7 +71568,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -70313,8 +71608,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -70525,10 +71820,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -70607,17 +71903,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -70629,7 +71925,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -70649,9 +71945,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -70659,10 +71957,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -70705,7 +72004,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -70786,11 +72085,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -70839,22 +72139,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -70867,14 +72169,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -70898,7 +72201,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -70965,10 +72268,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -70976,7 +72279,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -71004,15 +72314,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -71021,7 +72332,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -71130,8 +72442,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -71183,8 +72495,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -71198,8 +72510,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -71254,7 +72566,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -71293,8 +72606,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -71505,10 +72818,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -71587,17 +72901,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -71609,7 +72923,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -71629,9 +72943,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -71639,10 +72955,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -71685,7 +73002,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -71766,11 +73083,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -71819,22 +73137,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -71847,14 +73167,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -71878,7 +73199,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -71945,10 +73266,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -71956,7 +73277,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -71984,15 +73312,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -72001,7 +73330,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -72110,8 +73440,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -72163,8 +73493,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -72178,8 +73508,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -72234,7 +73564,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -72273,8 +73604,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -72485,10 +73816,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -72567,17 +73899,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -72589,7 +73921,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -72609,9 +73941,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -72619,10 +73953,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -72665,7 +74000,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -72746,11 +74081,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -72799,22 +74135,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -72827,14 +74165,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -72858,7 +74197,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -72925,10 +74264,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -72936,7 +74275,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -72964,15 +74310,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -72981,7 +74328,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -73090,8 +74438,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -73143,8 +74491,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -73158,8 +74506,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -73214,7 +74562,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -73253,8 +74602,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -73465,10 +74814,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -73547,17 +74897,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -73569,7 +74919,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -73589,9 +74939,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -73599,10 +74951,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -73645,7 +74998,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -73726,11 +75079,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -73779,22 +75133,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -73807,14 +75163,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -73838,7 +75195,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -73905,10 +75262,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -73916,7 +75273,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -73944,15 +75308,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -73961,7 +75326,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -74070,8 +75436,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -74123,8 +75489,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -74138,8 +75504,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -74194,7 +75560,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -74233,8 +75600,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -74445,10 +75812,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -74527,17 +75895,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -74549,7 +75917,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -74569,9 +75937,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -74579,10 +75949,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -74625,7 +75996,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -74706,11 +76077,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -74759,22 +76131,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -74787,14 +76161,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -74818,7 +76193,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -74885,10 +76260,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -74896,7 +76271,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -74924,15 +76306,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -74941,7 +76324,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -75050,8 +76434,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -75103,8 +76487,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -75118,8 +76502,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -75174,7 +76558,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -75213,8 +76598,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -75425,10 +76810,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -75507,17 +76893,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -75529,7 +76915,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -75549,9 +76935,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -75559,10 +76947,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -75605,7 +76994,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -75686,11 +77075,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -75739,22 +77129,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -75767,14 +77159,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -75798,7 +77191,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -75865,10 +77258,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -75876,7 +77269,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -75904,15 +77304,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -75921,7 +77322,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -76030,8 +77432,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -76083,8 +77485,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -76098,8 +77500,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -76154,7 +77556,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -76193,8 +77596,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -76405,10 +77808,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -76487,17 +77891,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -76509,7 +77913,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -76529,9 +77933,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -76539,10 +77945,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -76585,7 +77992,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -76666,11 +78073,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -76719,22 +78127,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -76747,14 +78157,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -76778,7 +78189,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -76845,10 +78256,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -76856,7 +78267,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -76884,15 +78302,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -76901,7 +78320,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -77010,8 +78430,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -77063,8 +78483,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -77078,8 +78498,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -77134,7 +78554,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -77173,8 +78594,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -77385,10 +78806,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -77467,17 +78889,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -77489,7 +78911,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -77509,9 +78931,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -77519,10 +78943,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -77565,7 +78990,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -77646,11 +79071,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -77699,22 +79125,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -77727,14 +79155,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -77758,7 +79187,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -77825,10 +79254,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -77836,7 +79265,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -77864,15 +79300,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -77881,7 +79318,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -77990,8 +79428,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -78043,8 +79481,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -78058,8 +79496,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -78114,7 +79552,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -78153,8 +79592,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -78365,10 +79804,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -78447,17 +79887,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -78469,7 +79909,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -78489,9 +79929,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -78499,10 +79941,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -78545,7 +79988,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -78626,11 +80069,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -78679,22 +80123,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -78707,14 +80153,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -78738,7 +80185,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -78805,10 +80252,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -78816,7 +80263,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -78844,15 +80298,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -78861,7 +80316,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -78970,8 +80426,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -79023,8 +80479,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -79038,8 +80494,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -79094,7 +80550,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -79133,8 +80590,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -79345,10 +80802,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -79427,17 +80885,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -79449,7 +80907,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -79469,9 +80927,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -79479,10 +80939,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -79525,7 +80986,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -79606,11 +81067,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -79659,22 +81121,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -79687,14 +81151,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -79718,7 +81183,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -79785,10 +81250,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -79796,7 +81261,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -79824,15 +81296,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -79841,7 +81314,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -79950,8 +81424,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -80003,8 +81477,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -80018,8 +81492,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -80074,7 +81548,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -80113,8 +81588,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -80325,10 +81800,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -80407,17 +81883,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -80429,7 +81905,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -80449,9 +81925,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -80459,10 +81937,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -80505,7 +81984,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -80586,11 +82065,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -80639,22 +82119,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -80667,14 +82149,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -80698,7 +82181,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -80765,10 +82248,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -80776,7 +82259,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -80804,15 +82294,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -80821,7 +82312,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -80930,8 +82422,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -80983,8 +82475,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -80998,8 +82490,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -81054,7 +82546,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -81093,8 +82586,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -81305,10 +82798,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -81387,17 +82881,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -81409,7 +82903,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -81429,9 +82923,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -81439,10 +82935,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -81485,7 +82982,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -81566,11 +83063,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -81619,22 +83117,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -81647,14 +83147,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -81678,7 +83179,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -81745,10 +83246,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -81756,7 +83257,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -81784,15 +83292,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -81801,7 +83310,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -81910,8 +83420,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -81963,8 +83473,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -81978,8 +83488,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -82034,7 +83544,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -82073,8 +83584,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -82285,10 +83796,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -82367,17 +83879,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -82389,7 +83901,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -82409,9 +83921,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -82419,10 +83933,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -82465,7 +83980,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -82546,11 +84061,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -82599,22 +84115,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -82627,14 +84145,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -82658,7 +84177,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -82725,10 +84244,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -82736,7 +84255,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -82764,15 +84290,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -82781,7 +84308,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -82890,8 +84418,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -82943,8 +84471,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -82958,8 +84486,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -83014,7 +84542,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -83053,8 +84582,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -83265,10 +84794,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -83347,17 +84877,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -83369,7 +84899,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -83389,9 +84919,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -83399,10 +84931,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -83445,7 +84978,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -83526,11 +85059,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -83579,22 +85113,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -83607,14 +85143,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -83638,7 +85175,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -83705,10 +85242,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -83716,7 +85253,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -83744,15 +85288,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -83761,7 +85306,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -83870,8 +85416,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -83923,8 +85469,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -83938,8 +85484,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -83994,7 +85540,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -84033,8 +85580,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -84245,10 +85792,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -84327,17 +85875,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -84349,7 +85897,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -84369,9 +85917,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -84379,10 +85929,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -84425,7 +85976,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -84506,11 +86057,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -84559,22 +86111,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -84587,14 +86141,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -84618,7 +86173,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -84685,10 +86240,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -84696,7 +86251,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -84724,15 +86286,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -84741,7 +86304,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -84850,8 +86414,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -84903,8 +86467,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -84918,8 +86482,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -84974,7 +86538,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -85013,8 +86578,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -85225,10 +86790,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -85307,17 +86873,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -85329,7 +86895,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -85349,9 +86915,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -85359,10 +86927,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -85405,7 +86974,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -85486,11 +87055,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -85539,22 +87109,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -85567,14 +87139,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -85598,7 +87171,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -85665,10 +87238,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -85676,7 +87249,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -85704,15 +87284,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -85721,7 +87302,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -85830,8 +87412,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -85883,8 +87465,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -85898,8 +87480,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -85954,7 +87536,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -85993,8 +87576,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -86205,10 +87788,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -86287,17 +87871,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -86309,7 +87893,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -86329,9 +87913,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -86339,10 +87925,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -86385,7 +87972,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -86466,11 +88053,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -86519,22 +88107,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -86547,14 +88137,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -86578,7 +88169,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -86645,10 +88236,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -86656,7 +88247,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -86684,15 +88282,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -86701,7 +88300,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -86810,8 +88410,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -86863,8 +88463,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -86878,8 +88478,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -86934,7 +88534,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -86973,8 +88574,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -87185,10 +88786,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -87267,17 +88869,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -87289,7 +88891,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -87309,9 +88911,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -87319,10 +88923,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -87365,7 +88970,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -87446,11 +89051,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -87499,22 +89105,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -87527,14 +89135,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -87558,7 +89167,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -87625,10 +89234,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -87636,7 +89245,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -87664,15 +89280,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -87681,7 +89298,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -87790,8 +89408,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -87843,8 +89461,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -87858,8 +89476,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -87914,7 +89532,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -87953,8 +89572,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -88165,10 +89784,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -88247,17 +89867,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -88269,7 +89889,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -88289,9 +89909,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -88299,10 +89921,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -88345,7 +89968,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -88426,11 +90049,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -88479,22 +90103,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -88507,14 +90133,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -88538,7 +90165,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -88605,10 +90232,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -88616,7 +90243,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -88644,15 +90278,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -88661,7 +90296,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -88770,8 +90406,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -88823,8 +90459,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -88838,8 +90474,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -88894,7 +90530,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -88933,8 +90570,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -89145,10 +90782,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -89227,17 +90865,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -89249,7 +90887,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -89269,9 +90907,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -89279,10 +90919,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -89325,7 +90966,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -89406,11 +91047,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -89459,22 +91101,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -89487,14 +91131,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -89518,7 +91163,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -89585,10 +91230,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -89596,7 +91241,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -89624,15 +91276,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -89641,7 +91294,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -89750,8 +91404,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -89803,8 +91457,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -89818,8 +91472,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -89874,7 +91528,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -89913,8 +91568,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -90125,10 +91780,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -90207,17 +91863,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -90229,7 +91885,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -90249,9 +91905,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -90259,10 +91917,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -90305,7 +91964,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -90386,11 +92045,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -90439,22 +92099,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -90467,14 +92129,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -90498,7 +92161,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -90565,10 +92228,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -90576,7 +92239,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -90604,15 +92274,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -90621,7 +92292,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -90730,8 +92402,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -90783,8 +92455,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -90798,8 +92470,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -90854,7 +92526,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -90893,8 +92566,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -91105,10 +92778,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -91187,17 +92861,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -91209,7 +92883,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -91229,9 +92903,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -91239,10 +92915,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -91285,7 +92962,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -91366,11 +93043,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -91419,22 +93097,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -91447,14 +93127,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -91478,7 +93159,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -91545,10 +93226,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -91556,7 +93237,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -91584,15 +93272,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -91601,7 +93290,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -91710,8 +93400,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -91763,8 +93453,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -91778,8 +93468,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -91834,7 +93524,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -91873,8 +93564,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -92085,10 +93776,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -92167,17 +93859,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -92189,7 +93881,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -92209,9 +93901,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -92219,10 +93913,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -92265,7 +93960,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -92346,11 +94041,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -92399,22 +94095,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -92427,14 +94125,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -92458,7 +94157,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -92525,10 +94224,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -92536,7 +94235,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -92564,15 +94270,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -92581,7 +94288,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -92690,8 +94398,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -92743,8 +94451,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -92758,8 +94466,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -92814,7 +94522,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -92853,8 +94562,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -93065,10 +94774,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -93147,17 +94857,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -93169,7 +94879,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -93189,9 +94899,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -93199,10 +94911,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -93245,7 +94958,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -93326,11 +95039,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -93379,22 +95093,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -93407,14 +95123,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -93438,7 +95155,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -93505,10 +95222,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -93516,7 +95233,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -93544,15 +95268,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -93561,7 +95286,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -93670,8 +95396,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -93723,8 +95449,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -93738,8 +95464,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -93794,7 +95520,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -93833,8 +95560,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -94045,10 +95772,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -94127,17 +95855,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -94149,7 +95877,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -94169,9 +95897,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -94179,10 +95909,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -94225,7 +95956,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -94306,11 +96037,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -94359,22 +96091,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -94387,14 +96121,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -94418,7 +96153,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -94485,10 +96220,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -94496,7 +96231,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -94524,15 +96266,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -94541,7 +96284,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -94650,8 +96394,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -94703,8 +96447,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -94718,8 +96462,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -94774,7 +96518,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -94813,8 +96558,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -95025,10 +96770,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -95107,17 +96853,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -95129,7 +96875,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -95149,9 +96895,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -95159,10 +96907,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -95205,7 +96954,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -95286,11 +97035,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -95339,22 +97089,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -95367,14 +97119,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -95398,7 +97151,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -95465,10 +97218,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -95476,7 +97229,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -95504,15 +97264,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -95521,7 +97282,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -95630,8 +97392,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -95683,8 +97445,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -95698,8 +97460,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -95754,7 +97516,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -95793,8 +97556,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -96005,10 +97768,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -96087,17 +97851,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -96109,7 +97873,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -96129,9 +97893,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -96139,10 +97905,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -96185,7 +97952,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -96266,11 +98033,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -96319,22 +98087,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -96347,14 +98117,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -96378,7 +98149,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -96445,10 +98216,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -96456,7 +98227,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -96484,15 +98262,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -96501,7 +98280,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -96610,8 +98390,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -96663,8 +98443,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -96678,8 +98458,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -96734,7 +98514,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -96773,8 +98554,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -96985,10 +98766,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -97067,17 +98849,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -97089,7 +98871,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -97109,9 +98891,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -97119,10 +98903,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -97165,7 +98950,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -97246,11 +99031,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -97299,22 +99085,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -97327,14 +99115,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -97358,7 +99147,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -97425,10 +99214,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -97436,7 +99225,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -97464,15 +99260,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -97481,7 +99278,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -97590,8 +99388,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -97643,8 +99441,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -97658,8 +99456,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -97714,7 +99512,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -97753,8 +99552,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -97965,10 +99764,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -98047,17 +99847,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -98069,7 +99869,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -98089,9 +99889,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -98099,10 +99901,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -98145,7 +99948,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -98226,11 +100029,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -98279,22 +100083,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -98307,14 +100113,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -98338,7 +100145,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -98405,10 +100212,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -98416,7 +100223,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -98444,15 +100258,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -98461,7 +100276,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -98570,8 +100386,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -98623,8 +100439,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -98638,8 +100454,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -98694,7 +100510,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -98733,8 +100550,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -98945,10 +100762,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -99027,17 +100845,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -99049,7 +100867,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -99069,9 +100887,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -99079,10 +100899,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -99125,7 +100946,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -99206,11 +101027,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -99259,22 +101081,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -99287,14 +101111,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -99318,7 +101143,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -99385,10 +101210,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -99396,7 +101221,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -99424,15 +101256,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -99441,7 +101274,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -99550,8 +101384,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -99603,8 +101437,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -99618,8 +101452,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -99674,7 +101508,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -99713,8 +101548,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -99925,10 +101760,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -100007,17 +101843,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -100029,7 +101865,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -100049,9 +101885,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -100059,10 +101897,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -100105,7 +101944,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -100186,11 +102025,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -100239,22 +102079,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -100267,14 +102109,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -100298,7 +102141,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -100365,10 +102208,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -100376,7 +102219,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -100404,15 +102254,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -100421,7 +102272,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -100530,8 +102382,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -100583,8 +102435,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -100598,8 +102450,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -100654,7 +102506,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -100693,8 +102546,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -100905,10 +102758,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -100987,17 +102841,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -101009,7 +102863,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -101029,9 +102883,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -101039,10 +102895,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -101085,7 +102942,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -101166,11 +103023,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -101219,22 +103077,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -101247,14 +103107,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -101278,7 +103139,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -101345,10 +103206,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -101356,7 +103217,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -101384,15 +103252,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -101401,7 +103270,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -101510,8 +103380,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -101563,8 +103433,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -101578,8 +103448,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -101634,7 +103504,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -101673,8 +103544,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -101885,10 +103756,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -101967,17 +103839,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -101989,7 +103861,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -102009,9 +103881,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -102019,10 +103893,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -102065,7 +103940,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -102146,11 +104021,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -102199,22 +104075,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -102227,14 +104105,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -102258,7 +104137,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -102325,10 +104204,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -102336,7 +104215,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -102364,15 +104250,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -102381,7 +104268,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -102490,8 +104378,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -102543,8 +104431,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -102558,8 +104446,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -102614,7 +104502,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -102653,8 +104542,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -102865,10 +104754,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -102947,17 +104837,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -102969,7 +104859,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -102989,9 +104879,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -102999,10 +104891,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -103045,7 +104938,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -103126,11 +105019,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -103179,22 +105073,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -103207,14 +105103,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -103238,7 +105135,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -103305,10 +105202,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -103316,7 +105213,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -103344,15 +105248,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -103361,7 +105266,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -103470,8 +105376,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -103523,8 +105429,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -103538,8 +105444,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -103594,7 +105500,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -103633,8 +105540,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -103845,10 +105752,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -103927,17 +105835,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -103949,7 +105857,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -103969,9 +105877,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -103979,10 +105889,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -104025,7 +105936,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -104106,11 +106017,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -104159,22 +106071,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -104187,14 +106101,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -104218,7 +106133,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -104285,10 +106200,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -104296,7 +106211,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -104324,15 +106246,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -104341,7 +106264,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -104450,8 +106374,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -104503,8 +106427,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -104518,8 +106442,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -104574,7 +106498,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -104613,8 +106538,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -104825,10 +106750,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -104907,17 +106833,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -104929,7 +106855,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -104949,9 +106875,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -104959,10 +106887,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -105005,7 +106934,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -105086,11 +107015,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -105139,22 +107069,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -105167,14 +107099,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -105198,7 +107131,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -105265,10 +107198,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -105276,7 +107209,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -105304,15 +107244,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -105321,7 +107262,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -105430,8 +107372,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -105483,8 +107425,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -105498,8 +107440,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -105554,7 +107496,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -105593,8 +107536,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -105805,10 +107748,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -105887,17 +107831,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -105909,7 +107853,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -105929,9 +107873,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -105939,10 +107885,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -105985,7 +107932,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -106066,11 +108013,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -106119,22 +108067,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -106147,14 +108097,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -106178,7 +108129,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -106245,10 +108196,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -106256,7 +108207,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -106284,15 +108242,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -106301,7 +108260,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -106410,8 +108370,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -106463,8 +108423,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -106478,8 +108438,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -106534,7 +108494,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -106573,8 +108534,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -106785,10 +108746,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -106867,17 +108829,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -106889,7 +108851,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -106909,9 +108871,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -106919,10 +108883,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -106965,7 +108930,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -107046,11 +109011,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -107099,22 +109065,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -107127,14 +109095,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -107158,7 +109127,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -107225,10 +109194,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -107236,7 +109205,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -107264,15 +109240,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -107281,7 +109258,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -107390,8 +109368,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -107443,8 +109421,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -107458,8 +109436,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -107514,7 +109492,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -107553,8 +109532,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -107765,10 +109744,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -107847,17 +109827,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -107869,7 +109849,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -107889,9 +109869,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -107899,10 +109881,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -107945,7 +109928,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -108026,11 +110009,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -108079,22 +110063,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -108107,14 +110093,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -108138,7 +110125,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -108205,10 +110192,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -108216,7 +110203,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -108244,15 +110238,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -108261,7 +110256,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -108370,8 +110366,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -108423,8 +110419,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -108438,8 +110434,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -108494,7 +110490,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -108533,8 +110530,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -108745,10 +110742,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -108827,17 +110825,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -108849,7 +110847,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -108869,9 +110867,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -108879,10 +110879,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -108925,7 +110926,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -109006,11 +111007,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -109059,22 +111061,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -109087,14 +111091,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -109118,7 +111123,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -109185,10 +111190,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -109196,7 +111201,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -109224,15 +111236,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -109241,7 +111254,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -109350,8 +111364,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -109403,8 +111417,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -109418,8 +111432,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -109474,7 +111488,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -109513,8 +111528,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -109725,10 +111740,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -109807,17 +111823,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -109829,7 +111845,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -109849,9 +111865,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -109859,10 +111877,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -109905,7 +111924,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -109986,11 +112005,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -110039,22 +112059,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -110067,14 +112089,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -110098,7 +112121,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -110165,10 +112188,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -110176,7 +112199,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -110204,15 +112234,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -110221,7 +112252,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -110330,8 +112362,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -110383,8 +112415,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -110398,8 +112430,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -110454,7 +112486,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -110493,8 +112526,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -110705,10 +112738,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -110787,17 +112821,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -110809,7 +112843,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -110829,9 +112863,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -110839,10 +112875,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -110885,7 +112922,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -110966,11 +113003,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -111019,22 +113057,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -111047,14 +113087,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -111078,7 +113119,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -111145,10 +113186,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -111156,7 +113197,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -111184,15 +113232,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -111201,7 +113250,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -111310,8 +113360,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -111363,8 +113413,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -111378,8 +113428,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -111434,7 +113484,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -111473,8 +113524,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -111685,10 +113736,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -111767,17 +113819,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -111789,7 +113841,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -111809,9 +113861,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -111819,10 +113873,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -111865,7 +113920,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -111946,11 +114001,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -111999,22 +114055,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -112027,14 +114085,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -112058,7 +114117,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -112125,10 +114184,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -112136,7 +114195,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -112164,15 +114230,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -112181,7 +114248,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -112290,8 +114358,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -112343,8 +114411,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -112358,8 +114426,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -112414,7 +114482,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -112453,8 +114522,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -112665,10 +114734,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -112747,17 +114817,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -112769,7 +114839,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -112789,9 +114859,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -112799,10 +114871,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -112845,7 +114918,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -112926,11 +114999,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -112979,22 +115053,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -113007,14 +115083,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -113038,7 +115115,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -113105,10 +115182,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -113116,7 +115193,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -113144,15 +115228,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -113161,7 +115246,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -113270,8 +115356,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -113323,8 +115409,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -113338,8 +115424,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -113394,7 +115480,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -113433,8 +115520,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -113645,10 +115732,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -113727,17 +115815,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -113749,7 +115837,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -113769,9 +115857,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -113779,10 +115869,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -113825,7 +115916,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -113906,11 +115997,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -113959,22 +116051,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -113987,14 +116081,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -114018,7 +116113,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -114085,10 +116180,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -114096,7 +116191,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -114124,15 +116226,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -114141,7 +116244,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -114250,8 +116354,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -114303,8 +116407,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -114318,8 +116422,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -114374,7 +116478,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -114413,8 +116518,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -114625,10 +116730,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -114707,17 +116813,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -114729,7 +116835,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -114749,9 +116855,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -114759,10 +116867,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -114805,7 +116914,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -114886,11 +116995,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -114939,22 +117049,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -114967,14 +117079,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -114998,7 +117111,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -115065,10 +117178,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -115076,7 +117189,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -115104,15 +117224,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -115121,7 +117242,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -115230,8 +117352,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -115283,8 +117405,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -115298,8 +117420,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -115354,7 +117476,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -115393,8 +117516,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -115605,10 +117728,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -115687,17 +117811,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -115709,7 +117833,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -115729,9 +117853,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -115739,10 +117865,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -115785,7 +117912,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -115866,11 +117993,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -115919,22 +118047,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -115947,14 +118077,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -115978,7 +118109,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -116045,10 +118176,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -116056,7 +118187,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -116084,15 +118222,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -116101,7 +118240,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -116210,8 +118350,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -116263,8 +118403,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -116278,8 +118418,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -116334,7 +118474,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -116373,8 +118514,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -116585,10 +118726,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -116667,17 +118809,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -116689,7 +118831,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -116709,9 +118851,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -116719,10 +118863,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -116765,7 +118910,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -116846,11 +118991,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -116899,22 +119045,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -116927,14 +119075,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -116958,7 +119107,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -117025,10 +119174,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -117036,7 +119185,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -117064,15 +119220,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -117081,7 +119238,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -117190,8 +119348,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -117243,8 +119401,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -117258,8 +119416,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -117314,7 +119472,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -117353,8 +119512,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -117565,10 +119724,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -117647,17 +119807,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -117669,7 +119829,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -117689,9 +119849,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -117699,10 +119861,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -117745,7 +119908,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -117826,11 +119989,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -117879,22 +120043,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -117907,14 +120073,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -117938,7 +120105,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -118005,10 +120172,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -118016,7 +120183,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -118044,15 +120218,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -118061,7 +120236,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -118170,8 +120346,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -118223,8 +120399,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -118238,8 +120414,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -118294,7 +120470,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -118333,8 +120510,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -118545,10 +120722,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -118627,17 +120805,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -118649,7 +120827,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -118669,9 +120847,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -118679,10 +120859,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -118725,7 +120906,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -118806,11 +120987,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -118859,22 +121041,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -118887,14 +121071,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -118918,7 +121103,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -118985,10 +121170,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -118996,7 +121181,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -119024,15 +121216,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -119041,7 +121234,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -119150,8 +121344,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -119203,8 +121397,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -119218,8 +121412,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -119274,7 +121468,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -119313,8 +121508,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -119525,10 +121720,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -119607,17 +121803,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -119629,7 +121825,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -119649,9 +121845,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -119659,10 +121857,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -119705,7 +121904,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -119786,11 +121985,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -119839,22 +122039,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -119867,14 +122069,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -119898,7 +122101,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -119965,10 +122168,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -119976,7 +122179,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -120004,15 +122214,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -120021,7 +122232,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -120130,8 +122342,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -120183,8 +122395,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -120198,8 +122410,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -120254,7 +122466,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -120293,8 +122506,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -120505,10 +122718,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -120587,17 +122801,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -120609,7 +122823,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -120629,9 +122843,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -120639,10 +122855,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -120685,7 +122902,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -120766,11 +122983,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -120819,22 +123037,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -120847,14 +123067,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -120878,7 +123099,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -120945,10 +123166,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -120956,7 +123177,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -120984,15 +123212,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -121001,7 +123230,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -121110,8 +123340,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -121163,8 +123393,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -121178,8 +123408,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -121234,7 +123464,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -121273,8 +123504,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -121485,10 +123716,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -121567,17 +123799,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -121589,7 +123821,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -121609,9 +123841,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -121619,10 +123853,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -121665,7 +123900,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -121746,11 +123981,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -121799,22 +124035,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -121827,14 +124065,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -121858,7 +124097,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -121925,10 +124164,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -121936,7 +124175,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -121964,15 +124210,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -121981,7 +124228,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -122090,8 +124338,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -122143,8 +124391,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -122158,8 +124406,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -122214,7 +124462,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -122253,8 +124502,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -122465,10 +124714,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -122547,17 +124797,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -122569,7 +124819,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -122589,9 +124839,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -122599,10 +124851,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -122645,7 +124898,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -122726,11 +124979,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -122779,22 +125033,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -122807,14 +125063,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -122838,7 +125095,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -122905,10 +125162,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -122916,7 +125173,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -122944,15 +125208,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -122961,7 +125226,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -123070,8 +125336,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -123123,8 +125389,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -123138,8 +125404,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -123194,7 +125460,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -123233,8 +125500,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -123445,10 +125712,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -123527,17 +125795,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -123549,7 +125817,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -123569,9 +125837,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -123579,10 +125849,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -123625,7 +125896,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -123706,11 +125977,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -123759,22 +126031,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -123787,14 +126061,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -123818,7 +126093,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -123885,10 +126160,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -123896,7 +126171,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -123924,15 +126206,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -123941,7 +126224,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -124050,8 +126334,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -124103,8 +126387,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -124118,8 +126402,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -124174,7 +126458,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -124213,8 +126498,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -124425,10 +126710,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -124507,17 +126793,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -124529,7 +126815,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -124549,9 +126835,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -124559,10 +126847,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -124605,7 +126894,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -124686,11 +126975,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -124739,22 +127029,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -124767,14 +127059,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -124798,7 +127091,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -124865,10 +127158,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -124876,7 +127169,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -124904,15 +127204,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -124921,7 +127222,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -125030,8 +127332,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -125083,8 +127385,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -125098,8 +127400,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -125154,7 +127456,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -125193,8 +127496,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -125405,10 +127708,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -125487,17 +127791,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -125509,7 +127813,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -125529,9 +127833,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -125539,10 +127845,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -125585,7 +127892,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -125666,11 +127973,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -125719,22 +128027,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -125747,14 +128057,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -125778,7 +128089,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -125845,10 +128156,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -125856,7 +128167,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -125884,15 +128202,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -125901,7 +128220,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -126010,8 +128330,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -126063,8 +128383,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -126078,8 +128398,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -126134,7 +128454,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -126173,8 +128494,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -126385,10 +128706,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -126467,17 +128789,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -126489,7 +128811,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -126509,9 +128831,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -126519,10 +128843,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -126565,7 +128890,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -126646,11 +128971,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -126699,22 +129025,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -126727,14 +129055,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -126758,7 +129087,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -126825,10 +129154,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -126836,7 +129165,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -126864,15 +129200,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -126881,7 +129218,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -126990,8 +129328,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -127043,8 +129381,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -127058,8 +129396,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -127114,7 +129452,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -127153,8 +129492,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -127365,10 +129704,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -127447,17 +129787,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -127469,7 +129809,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -127489,9 +129829,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -127499,10 +129841,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -127545,7 +129888,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -127626,11 +129969,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -127679,22 +130023,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -127707,14 +130053,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -127738,7 +130085,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -127805,10 +130152,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -127816,7 +130163,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -127844,15 +130198,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -127861,7 +130216,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -127970,8 +130326,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -128023,8 +130379,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -128038,8 +130394,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -128094,7 +130450,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -128133,8 +130490,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -128345,10 +130702,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -128427,17 +130785,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -128449,7 +130807,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -128469,9 +130827,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -128479,10 +130839,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -128525,7 +130886,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -128606,11 +130967,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -128659,22 +131021,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -128687,14 +131051,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -128718,7 +131083,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -128785,10 +131150,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -128796,7 +131161,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -128824,15 +131196,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -128841,7 +131214,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -128950,8 +131324,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -129003,8 +131377,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -129018,8 +131392,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -129074,7 +131448,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -129113,8 +131488,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -129325,10 +131700,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -129407,17 +131783,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -129429,7 +131805,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -129449,9 +131825,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -129459,10 +131837,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -129505,7 +131884,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -129586,11 +131965,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -129639,22 +132019,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -129667,14 +132049,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -129698,7 +132081,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -129765,10 +132148,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -129776,7 +132159,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -129804,15 +132194,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -129821,7 +132212,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -129930,8 +132322,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -129983,8 +132375,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -129998,8 +132390,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -130054,7 +132446,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -130093,8 +132486,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -130305,10 +132698,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -130387,17 +132781,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -130409,7 +132803,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -130429,9 +132823,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -130439,10 +132835,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -130485,7 +132882,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -130566,11 +132963,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -130619,22 +133017,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -130647,14 +133047,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -130678,7 +133079,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -130745,10 +133146,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -130756,7 +133157,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -130784,15 +133192,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -130801,7 +133210,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -130910,8 +133320,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -130963,8 +133373,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -130978,8 +133388,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -131034,7 +133444,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -131073,8 +133484,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -131285,10 +133696,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -131367,17 +133779,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -131389,7 +133801,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -131409,9 +133821,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -131419,10 +133833,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -131465,7 +133880,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -131546,11 +133961,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -131599,22 +134015,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -131627,14 +134045,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -131658,7 +134077,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -131725,10 +134144,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -131736,7 +134155,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -131764,15 +134190,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -131781,7 +134208,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -131890,8 +134318,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -131943,8 +134371,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -131958,8 +134386,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -132014,7 +134442,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -132053,8 +134482,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -132265,10 +134694,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -132347,17 +134777,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -132369,7 +134799,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -132389,9 +134819,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -132399,10 +134831,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -132445,7 +134878,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -132526,11 +134959,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -132579,22 +135013,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -132607,14 +135043,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -132638,7 +135075,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -132705,10 +135142,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -132716,7 +135153,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -132744,15 +135188,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -132761,7 +135206,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -132870,8 +135316,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -132923,8 +135369,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -132938,8 +135384,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -132994,7 +135440,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -133033,8 +135480,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -133245,10 +135692,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -133327,17 +135775,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -133349,7 +135797,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -133369,9 +135817,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -133379,10 +135829,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -133425,7 +135876,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -133506,11 +135957,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -133559,22 +136011,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -133587,14 +136041,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -133618,7 +136073,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -133685,10 +136140,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -133696,7 +136151,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -133724,15 +136186,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -133741,7 +136204,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -133850,8 +136314,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -133903,8 +136367,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -133918,8 +136382,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -133974,7 +136438,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -134013,8 +136478,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -134225,10 +136690,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -134307,17 +136773,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -134329,7 +136795,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -134349,9 +136815,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -134359,10 +136827,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -134405,7 +136874,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -134486,11 +136955,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -134539,22 +137009,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -134567,14 +137039,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -134598,7 +137071,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -134665,10 +137138,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -134676,7 +137149,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -134704,15 +137184,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -134721,7 +137202,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -134830,8 +137312,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -134883,8 +137365,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -134898,8 +137380,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -134954,7 +137436,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -134993,8 +137476,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -135205,10 +137688,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -135287,17 +137771,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -135309,7 +137793,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -135329,9 +137813,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -135339,10 +137825,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -135385,7 +137872,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -135466,11 +137953,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -135519,22 +138007,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -135547,14 +138037,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -135578,7 +138069,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -135645,10 +138136,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -135656,7 +138147,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -135684,15 +138182,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -135701,7 +138200,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -135810,8 +138310,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -135863,8 +138363,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -135878,8 +138378,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -135934,7 +138434,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -135973,8 +138474,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -136185,10 +138686,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -136267,17 +138769,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -136289,7 +138791,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -136309,9 +138811,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -136319,10 +138823,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -136365,7 +138870,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -136446,11 +138951,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -136499,22 +139005,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -136527,14 +139035,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -136558,7 +139067,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -136625,10 +139134,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -136636,7 +139145,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -136664,15 +139180,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -136681,7 +139198,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -136790,8 +139308,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -136843,8 +139361,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -136858,8 +139376,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -136914,7 +139432,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -136953,8 +139472,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -137165,10 +139684,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -137247,17 +139767,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -137269,7 +139789,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -137289,9 +139809,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -137299,10 +139821,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -137345,7 +139868,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -137426,11 +139949,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -137479,22 +140003,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -137507,14 +140033,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -137538,7 +140065,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -137605,10 +140132,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -137616,7 +140143,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -137644,15 +140178,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -137661,7 +140196,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -137770,8 +140306,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -137823,8 +140359,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -137838,8 +140374,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -137894,7 +140430,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -137933,8 +140470,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -138145,10 +140682,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -138227,17 +140765,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -138249,7 +140787,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -138269,9 +140807,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -138279,10 +140819,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -138325,7 +140866,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -138406,11 +140947,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -138459,22 +141001,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -138487,14 +141031,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -138518,7 +141063,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -138585,10 +141130,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -138596,7 +141141,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -138624,15 +141176,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -138641,7 +141194,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -138750,8 +141304,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -138803,8 +141357,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -138818,8 +141372,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -138874,7 +141428,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -138913,8 +141468,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -139125,10 +141680,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -139207,17 +141763,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -139229,7 +141785,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -139249,9 +141805,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -139259,10 +141817,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -139305,7 +141864,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -139386,11 +141945,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -139439,22 +141999,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -139467,14 +142029,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -139498,7 +142061,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -139565,10 +142128,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -139576,7 +142139,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -139604,15 +142174,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -139621,7 +142192,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -139730,8 +142302,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -139783,8 +142355,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -139798,8 +142370,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -139854,7 +142426,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -139893,8 +142466,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -140105,10 +142678,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -140187,17 +142761,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -140209,7 +142783,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -140229,9 +142803,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -140239,10 +142815,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -140285,7 +142862,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -140366,11 +142943,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -140419,22 +142997,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -140447,14 +143027,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -140478,7 +143059,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -140545,10 +143126,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -140556,7 +143137,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -140584,15 +143172,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -140601,7 +143190,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -140710,8 +143300,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -140763,8 +143353,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -140778,8 +143368,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -140834,7 +143424,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -140873,8 +143464,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -141085,10 +143676,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -141167,17 +143759,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -141189,7 +143781,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -141209,9 +143801,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -141219,10 +143813,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -141265,7 +143860,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -141346,11 +143941,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -141399,22 +143995,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -141427,14 +144025,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -141458,7 +144057,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -141525,10 +144124,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -141536,7 +144135,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -141564,15 +144170,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -141581,7 +144188,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -141690,8 +144298,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -141743,8 +144351,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -141758,8 +144366,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -141814,7 +144422,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -141853,8 +144462,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -142065,10 +144674,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -142147,17 +144757,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -142169,7 +144779,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -142189,9 +144799,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -142199,10 +144811,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -142245,7 +144858,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -142326,11 +144939,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -142379,22 +144993,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -142407,14 +145023,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -142438,7 +145055,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -142505,10 +145122,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -142516,7 +145133,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -142544,15 +145168,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -142561,7 +145186,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -142670,8 +145296,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -142723,8 +145349,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -142738,8 +145364,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -142794,7 +145420,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -142833,8 +145460,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -143045,10 +145672,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -143127,17 +145755,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -143149,7 +145777,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -143169,9 +145797,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -143179,10 +145809,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -143225,7 +145856,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -143306,11 +145937,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -143359,22 +145991,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -143387,14 +146021,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -143418,7 +146053,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -143485,10 +146120,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -143496,7 +146131,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -143524,15 +146166,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -143541,7 +146184,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -143650,8 +146294,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -143703,8 +146347,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -143718,8 +146362,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -143774,7 +146418,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -143813,8 +146458,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -144025,10 +146670,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -144107,17 +146753,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -144129,7 +146775,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -144149,9 +146795,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -144159,10 +146807,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -144205,7 +146854,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -144286,11 +146935,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -144339,22 +146989,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -144367,14 +147019,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -144398,7 +147051,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -144465,10 +147118,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -144476,7 +147129,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -144504,15 +147164,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -144521,7 +147182,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -144630,8 +147292,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -144683,8 +147345,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -144698,8 +147360,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -144754,7 +147416,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -144793,8 +147456,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -145005,10 +147668,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -145087,17 +147751,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -145109,7 +147773,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -145129,9 +147793,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -145139,10 +147805,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -145185,7 +147852,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -145266,11 +147933,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -145319,22 +147987,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -145347,14 +148017,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -145378,7 +148049,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -145445,10 +148116,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -145456,7 +148127,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -145484,15 +148162,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -145501,7 +148180,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -145610,8 +148290,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -145663,8 +148343,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -145678,8 +148358,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -145734,7 +148414,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -145773,8 +148454,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -145985,10 +148666,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -146067,17 +148749,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -146089,7 +148771,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -146109,9 +148791,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -146119,10 +148803,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -146165,7 +148850,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -146246,11 +148931,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -146299,22 +148985,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -146327,14 +149015,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -146358,7 +149047,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -146425,10 +149114,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -146436,7 +149125,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -146464,15 +149160,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -146481,7 +149178,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -146590,8 +149288,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -146643,8 +149341,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -146658,8 +149356,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -146714,7 +149412,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -146753,8 +149452,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -146965,10 +149664,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -147047,17 +149747,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -147069,7 +149769,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -147089,9 +149789,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -147099,10 +149801,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -147145,7 +149848,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -147226,11 +149929,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -147279,22 +149983,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -147307,14 +150013,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -147338,7 +150045,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -147405,10 +150112,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -147416,7 +150123,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -147444,15 +150158,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -147461,7 +150176,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -147570,8 +150286,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -147623,8 +150339,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -147638,8 +150354,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -147694,7 +150410,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -147733,8 +150450,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -147945,10 +150662,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -148027,17 +150745,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -148049,7 +150767,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -148069,9 +150787,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -148079,10 +150799,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -148125,7 +150846,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -148206,11 +150927,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -148259,22 +150981,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -148287,14 +151011,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -148318,7 +151043,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -148385,10 +151110,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -148396,7 +151121,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -148424,15 +151156,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -148441,7 +151174,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -148550,8 +151284,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -148603,8 +151337,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -148618,8 +151352,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -148674,7 +151408,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -148713,8 +151448,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -148925,10 +151660,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -149007,17 +151743,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -149029,7 +151765,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -149049,9 +151785,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -149059,10 +151797,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -149105,7 +151844,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -149186,11 +151925,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -149239,22 +151979,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -149267,14 +152009,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -149298,7 +152041,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -149365,10 +152108,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -149376,7 +152119,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -149404,15 +152154,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -149421,7 +152172,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -149530,8 +152282,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -149583,8 +152335,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -149598,8 +152350,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -149654,7 +152406,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -149693,8 +152446,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -149905,10 +152658,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -149987,17 +152741,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -150009,7 +152763,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -150029,9 +152783,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -150039,10 +152795,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -150085,7 +152842,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -150166,11 +152923,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -150219,22 +152977,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -150247,14 +153007,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -150278,7 +153039,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -150345,10 +153106,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -150356,7 +153117,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -150384,15 +153152,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -150401,7 +153170,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -150510,8 +153280,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -150563,8 +153333,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -150578,8 +153348,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -150634,7 +153404,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -150673,8 +153444,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -150885,10 +153656,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -150967,17 +153739,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -150989,7 +153761,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -151009,9 +153781,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -151019,10 +153793,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -151065,7 +153840,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -151146,11 +153921,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -151199,22 +153975,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -151227,14 +154005,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -151258,7 +154037,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -151325,10 +154104,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -151336,7 +154115,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -151364,15 +154150,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -151381,7 +154168,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -151490,8 +154278,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -151543,8 +154331,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -151558,8 +154346,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -151614,7 +154402,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -151653,8 +154442,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -151865,10 +154654,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -151947,17 +154737,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -151969,7 +154759,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -151989,9 +154779,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -151999,10 +154791,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -152045,7 +154838,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -152126,11 +154919,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -152179,22 +154973,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -152207,14 +155003,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -152238,7 +155035,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -152305,10 +155102,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -152316,7 +155113,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -152344,15 +155148,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -152361,7 +155166,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -152470,8 +155276,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -152523,8 +155329,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -152538,8 +155344,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -152594,7 +155400,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -152633,8 +155440,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -152845,10 +155652,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -152927,17 +155735,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -152949,7 +155757,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -152969,9 +155777,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -152979,10 +155789,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -153025,7 +155836,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -153106,11 +155917,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -153159,22 +155971,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -153187,14 +156001,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -153218,7 +156033,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -153285,10 +156100,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -153296,7 +156111,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -153324,15 +156146,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -153341,7 +156164,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -153450,8 +156274,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -153503,8 +156327,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -153518,8 +156342,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -153574,7 +156398,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -153613,8 +156438,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -153825,10 +156650,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -153907,17 +156733,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -153929,7 +156755,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -153949,9 +156775,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -153959,10 +156787,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -154005,7 +156834,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -154086,11 +156915,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -154139,22 +156969,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -154167,14 +156999,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -154198,7 +157031,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -154265,10 +157098,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -154276,7 +157109,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -154304,15 +157144,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -154321,7 +157162,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -154430,8 +157272,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -154483,8 +157325,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -154498,8 +157340,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -154554,7 +157396,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -154593,8 +157436,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -154805,10 +157648,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -154887,17 +157731,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -154909,7 +157753,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -154929,9 +157773,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -154939,10 +157785,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -154985,7 +157832,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -155066,11 +157913,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -155119,22 +157967,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -155147,14 +157997,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -155178,7 +158029,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -155245,10 +158096,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -155256,7 +158107,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -155284,15 +158142,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -155301,7 +158160,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -155410,8 +158270,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -155463,8 +158323,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -155478,8 +158338,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -155534,7 +158394,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -155573,8 +158434,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -155785,10 +158646,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -155867,17 +158729,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -155889,7 +158751,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -155909,9 +158771,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -155919,10 +158783,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -155965,7 +158830,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -156046,11 +158911,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -156099,22 +158965,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -156127,14 +158995,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -156158,7 +159027,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -156225,10 +159094,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -156236,7 +159105,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -156264,15 +159140,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -156281,7 +159158,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -156390,8 +159268,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -156443,8 +159321,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -156458,8 +159336,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -156514,7 +159392,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -156553,8 +159432,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -156765,10 +159644,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -156847,17 +159727,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -156869,7 +159749,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -156889,9 +159769,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -156899,10 +159781,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -156945,7 +159828,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -157026,11 +159909,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -157079,22 +159963,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -157107,14 +159993,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -157138,7 +160025,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -157205,10 +160092,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -157216,7 +160103,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -157244,15 +160138,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -157261,7 +160156,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -157370,8 +160266,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -157423,8 +160319,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -157438,8 +160334,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -157494,7 +160390,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -157533,8 +160430,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -157745,10 +160642,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -157827,17 +160725,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -157849,7 +160747,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -157869,9 +160767,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -157879,10 +160779,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -157925,7 +160826,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -158006,11 +160907,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -158059,22 +160961,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -158087,14 +160991,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -158118,7 +161023,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -158185,10 +161090,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -158196,7 +161101,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -158224,15 +161136,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -158241,7 +161154,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -158350,8 +161264,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -158403,8 +161317,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -158418,8 +161332,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -158474,7 +161388,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -158513,8 +161428,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -158725,10 +161640,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -158807,17 +161723,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -158829,7 +161745,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -158849,9 +161765,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -158859,10 +161777,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -158905,7 +161824,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -158986,11 +161905,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -159039,22 +161959,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -159067,14 +161989,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -159098,7 +162021,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -159165,10 +162088,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -159176,7 +162099,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -159204,15 +162134,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -159221,7 +162152,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -159330,8 +162262,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -159383,8 +162315,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -159398,8 +162330,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -159454,7 +162386,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -159493,8 +162426,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -159705,10 +162638,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -159787,17 +162721,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -159809,7 +162743,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -159829,9 +162763,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -159839,10 +162775,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -159885,7 +162822,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -159966,11 +162903,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -160019,22 +162957,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -160047,14 +162987,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -160078,7 +163019,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -160145,10 +163086,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -160156,7 +163097,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -160184,15 +163132,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -160201,7 +163150,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -160310,8 +163260,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -160363,8 +163313,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -160378,8 +163328,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -160434,7 +163384,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -160473,8 +163424,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -160685,10 +163636,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -160767,17 +163719,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -160789,7 +163741,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -160809,9 +163761,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -160819,10 +163773,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -160865,7 +163820,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -160946,11 +163901,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -160999,22 +163955,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -161027,14 +163985,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -161058,7 +164017,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -161125,10 +164084,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -161136,7 +164095,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -161164,15 +164130,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -161181,7 +164148,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -161290,8 +164258,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -161343,8 +164311,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -161358,8 +164326,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -161414,7 +164382,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -161453,8 +164422,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -161665,10 +164634,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -161747,17 +164717,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -161769,7 +164739,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -161789,9 +164759,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -161799,10 +164771,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -161845,7 +164818,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -161926,11 +164899,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -161979,22 +164953,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -162007,14 +164983,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -162038,7 +165015,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -162105,10 +165082,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -162116,7 +165093,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -162144,15 +165128,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -162161,7 +165146,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -162270,8 +165256,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -162323,8 +165309,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -162338,8 +165324,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -162394,7 +165380,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -162433,8 +165420,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -162645,10 +165632,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -162727,17 +165715,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -162749,7 +165737,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -162769,9 +165757,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -162779,10 +165769,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -162825,7 +165816,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -162906,11 +165897,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -162959,22 +165951,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -162987,14 +165981,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -163018,7 +166013,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -163085,10 +166080,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -163096,7 +166091,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -163124,15 +166126,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -163141,7 +166144,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -163250,8 +166254,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -163303,8 +166307,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -163318,8 +166322,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -163374,7 +166378,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -163413,8 +166418,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -163625,10 +166630,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -163707,17 +166713,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -163729,7 +166735,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -163749,9 +166755,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -163759,10 +166767,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -163805,7 +166814,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -163886,11 +166895,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -163939,22 +166949,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -163967,14 +166979,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -163998,7 +167011,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -164065,10 +167078,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -164076,7 +167089,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -164104,15 +167124,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -164121,7 +167142,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -164230,8 +167252,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -164283,8 +167305,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -164298,8 +167320,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -164354,7 +167376,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -164393,8 +167416,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -164605,10 +167628,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -164687,17 +167711,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -164709,7 +167733,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -164729,9 +167753,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -164739,10 +167765,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -164785,7 +167812,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -164866,11 +167893,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -164919,22 +167947,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -164947,14 +167977,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -164978,7 +168009,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -165045,10 +168076,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -165056,7 +168087,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -165084,15 +168122,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -165101,7 +168140,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -165210,8 +168250,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -165263,8 +168303,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -165278,8 +168318,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -165334,7 +168374,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -165373,8 +168414,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -165585,10 +168626,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -165667,17 +168709,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -165689,7 +168731,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -165709,9 +168751,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -165719,10 +168763,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -165765,7 +168810,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -165846,11 +168891,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -165899,22 +168945,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -165927,14 +168975,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -165958,7 +169007,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -166025,10 +169074,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -166036,7 +169085,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -166064,15 +169120,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -166081,7 +169138,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -166190,8 +169248,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -166243,8 +169301,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -166258,8 +169316,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -166314,7 +169372,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -166353,8 +169412,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -166565,10 +169624,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -166647,17 +169707,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -166669,7 +169729,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -166689,9 +169749,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -166699,10 +169761,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -166745,7 +169808,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -166826,11 +169889,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -166879,22 +169943,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -166907,14 +169973,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -166938,7 +170005,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -167005,10 +170072,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -167016,7 +170083,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -167044,15 +170118,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -167061,7 +170136,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -167170,8 +170246,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -167223,8 +170299,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -167238,8 +170314,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -167294,7 +170370,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -167333,8 +170410,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -167545,10 +170622,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -167627,17 +170705,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -167649,7 +170727,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -167669,9 +170747,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -167679,10 +170759,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -167725,7 +170806,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -167806,11 +170887,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -167859,22 +170941,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -167887,14 +170971,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -167918,7 +171003,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -167985,10 +171070,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -167996,7 +171081,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -168024,15 +171116,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -168041,7 +171134,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -168150,8 +171244,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -168203,8 +171297,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -168218,8 +171312,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -168274,7 +171368,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -168313,8 +171408,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -168525,10 +171620,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -168607,17 +171703,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -168629,7 +171725,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -168649,9 +171745,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -168659,10 +171757,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -168705,7 +171804,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -168786,11 +171885,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -168839,22 +171939,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -168867,14 +171969,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -168898,7 +172001,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -168965,10 +172068,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -168976,7 +172079,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -169004,15 +172114,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -169021,7 +172132,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -169130,8 +172242,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -169183,8 +172295,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -169198,8 +172310,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -169254,7 +172366,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -169293,8 +172406,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -169505,10 +172618,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -169587,17 +172701,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -169609,7 +172723,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -169629,9 +172743,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -169639,10 +172755,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -169685,7 +172802,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -169766,11 +172883,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -169819,22 +172937,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -169847,14 +172967,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -169878,7 +172999,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -169945,10 +173066,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -169956,7 +173077,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -169984,15 +173112,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -170001,7 +173130,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -170110,8 +173240,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -170163,8 +173293,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -170178,8 +173308,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -170234,7 +173364,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -170273,8 +173404,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -170485,10 +173616,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -170567,17 +173699,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -170589,7 +173721,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -170609,9 +173741,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -170619,10 +173753,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -170665,7 +173800,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -170746,11 +173881,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -170799,22 +173935,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -170827,14 +173965,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -170858,7 +173997,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -170925,10 +174064,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -170936,7 +174075,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -170964,15 +174110,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -170981,7 +174128,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -171090,8 +174238,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -171143,8 +174291,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -171158,8 +174306,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -171214,7 +174362,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -171253,8 +174402,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -171465,10 +174614,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -171547,17 +174697,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -171569,7 +174719,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -171589,9 +174739,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -171599,10 +174751,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -171645,7 +174798,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -171726,11 +174879,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -171779,22 +174933,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -171807,14 +174963,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -171838,7 +174995,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -171905,10 +175062,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -171916,7 +175073,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -171944,15 +175108,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -171961,7 +175126,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -172070,8 +175236,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -172123,8 +175289,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -172138,8 +175304,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -172194,7 +175360,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -172233,8 +175400,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -172445,10 +175612,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -172527,17 +175695,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -172549,7 +175717,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -172569,9 +175737,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -172579,10 +175749,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -172625,7 +175796,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -172706,11 +175877,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -172759,22 +175931,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -172787,14 +175961,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -172818,7 +175993,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -172885,10 +176060,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -172896,7 +176071,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -172924,15 +176106,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -172941,7 +176124,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -173050,8 +176234,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -173103,8 +176287,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -173118,8 +176302,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -173174,7 +176358,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -173213,8 +176398,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -173425,10 +176610,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -173507,17 +176693,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -173529,7 +176715,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -173549,9 +176735,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -173559,10 +176747,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -173605,7 +176794,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -173686,11 +176875,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -173739,22 +176929,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -173767,14 +176959,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -173798,7 +176991,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -173865,10 +177058,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -173876,7 +177069,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -173904,15 +177104,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -173921,7 +177122,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -174030,8 +177232,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -174083,8 +177285,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -174098,8 +177300,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -174154,7 +177356,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -174193,8 +177396,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -174405,10 +177608,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -174487,17 +177691,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -174509,7 +177713,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -174529,9 +177733,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -174539,10 +177745,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -174585,7 +177792,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -174666,11 +177873,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -174719,22 +177927,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -174747,14 +177957,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -174778,7 +177989,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -174845,10 +178056,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -174856,7 +178067,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -174884,15 +178102,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -174901,7 +178120,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -175010,8 +178230,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -175063,8 +178283,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -175078,8 +178298,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -175134,7 +178354,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -175173,8 +178394,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -175385,10 +178606,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -175467,17 +178689,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -175489,7 +178711,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -175509,9 +178731,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -175519,10 +178743,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -175565,7 +178790,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -175646,11 +178871,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -175699,22 +178925,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -175727,14 +178955,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -175758,7 +178987,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -175825,10 +179054,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -175836,7 +179065,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -175864,15 +179100,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -175881,7 +179118,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -175990,8 +179228,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -176043,8 +179281,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -176058,8 +179296,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -176114,7 +179352,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -176153,8 +179392,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -176365,10 +179604,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -176447,17 +179687,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -176469,7 +179709,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -176489,9 +179729,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -176499,10 +179741,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -176545,7 +179788,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -176626,11 +179869,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -176679,22 +179923,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -176707,14 +179953,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -176738,7 +179985,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -176805,10 +180052,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -176816,7 +180063,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -176844,15 +180098,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -176861,7 +180116,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -176970,8 +180226,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -177023,8 +180279,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -177038,8 +180294,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -177094,7 +180350,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -177133,8 +180390,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -177345,10 +180602,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -177427,17 +180685,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -177449,7 +180707,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -177469,9 +180727,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -177479,10 +180739,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -177525,7 +180786,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -177606,11 +180867,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -177659,22 +180921,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -177687,14 +180951,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -177718,7 +180983,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -177785,10 +181050,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -177796,7 +181061,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -177824,15 +181096,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -177841,7 +181114,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -177950,8 +181224,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -178003,8 +181277,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -178018,8 +181292,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -178074,7 +181348,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -178113,8 +181388,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -178325,10 +181600,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -178407,17 +181683,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -178429,7 +181705,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -178449,9 +181725,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -178459,10 +181737,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -178505,7 +181784,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -178586,11 +181865,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -178639,22 +181919,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -178667,14 +181949,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -178698,7 +181981,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -178765,10 +182048,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -178776,7 +182059,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -178804,15 +182094,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -178821,7 +182112,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -178930,8 +182222,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -178983,8 +182275,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -178998,8 +182290,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -179054,7 +182346,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -179093,8 +182386,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -179305,10 +182598,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -179387,17 +182681,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -179409,7 +182703,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -179429,9 +182723,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -179439,10 +182735,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -179485,7 +182782,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -179566,11 +182863,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -179619,22 +182917,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -179647,14 +182947,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -179678,7 +182979,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -179745,10 +183046,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -179756,7 +183057,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -179784,15 +183092,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -179801,7 +183110,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -179910,8 +183220,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -179963,8 +183273,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -179978,8 +183288,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -180034,7 +183344,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -180073,8 +183384,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -180285,10 +183596,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -180367,17 +183679,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -180389,7 +183701,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -180409,9 +183721,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -180419,10 +183733,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -180465,7 +183780,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -180546,11 +183861,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -180599,22 +183915,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -180627,14 +183945,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -180658,7 +183977,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -180725,10 +184044,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -180736,7 +184055,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -180764,15 +184090,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -180781,7 +184108,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -180890,8 +184218,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -180943,8 +184271,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -180958,8 +184286,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -181014,7 +184342,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -181053,8 +184382,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -181265,10 +184594,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -181347,17 +184677,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -181369,7 +184699,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -181389,9 +184719,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -181399,10 +184731,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -181445,7 +184778,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -181526,11 +184859,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -181579,22 +184913,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -181607,14 +184943,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -181638,7 +184975,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -181705,10 +185042,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -181716,7 +185053,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -181744,15 +185088,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -181761,7 +185106,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -181870,8 +185216,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -181923,8 +185269,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -181938,8 +185284,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -181994,7 +185340,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -182033,8 +185380,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -182245,10 +185592,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -182327,17 +185675,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -182349,7 +185697,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -182369,9 +185717,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -182379,10 +185729,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -182425,7 +185776,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -182506,11 +185857,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -182559,22 +185911,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -182587,14 +185941,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -182618,7 +185973,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -182685,10 +186040,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -182696,7 +186051,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -182724,15 +186086,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -182741,7 +186104,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -182850,8 +186214,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -182903,8 +186267,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -182918,8 +186282,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -182974,7 +186338,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -183013,8 +186378,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -183225,10 +186590,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -183307,17 +186673,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -183329,7 +186695,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -183349,9 +186715,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -183359,10 +186727,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -183405,7 +186774,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -183486,11 +186855,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -183539,22 +186909,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -183567,14 +186939,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -183598,7 +186971,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -183665,10 +187038,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -183676,7 +187049,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -183704,15 +187084,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -183721,7 +187102,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -183830,8 +187212,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -183883,8 +187265,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -183898,8 +187280,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -183954,7 +187336,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -183993,8 +187376,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -184205,10 +187588,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -184287,17 +187671,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -184309,7 +187693,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -184329,9 +187713,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -184339,10 +187725,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -184385,7 +187772,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -184466,11 +187853,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -184519,22 +187907,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -184547,14 +187937,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -184578,7 +187969,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -184645,10 +188036,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -184656,7 +188047,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -184684,15 +188082,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -184701,7 +188100,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -184810,8 +188210,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -184863,8 +188263,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -184878,8 +188278,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -184934,7 +188334,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -184973,8 +188374,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -185185,10 +188586,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -185267,17 +188669,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -185289,7 +188691,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -185309,9 +188711,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -185319,10 +188723,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -185365,7 +188770,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -185446,11 +188851,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -185499,22 +188905,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -185527,14 +188935,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -185558,7 +188967,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -185625,10 +189034,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -185636,7 +189045,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -185664,15 +189080,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -185681,7 +189098,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -185790,8 +189208,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -185843,8 +189261,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -185858,8 +189276,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -185914,7 +189332,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -185953,8 +189372,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -186165,10 +189584,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -186247,17 +189667,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -186269,7 +189689,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -186289,9 +189709,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -186299,10 +189721,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -186345,7 +189768,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -186426,11 +189849,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -186479,22 +189903,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -186507,14 +189933,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -186538,7 +189965,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -186605,10 +190032,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -186616,7 +190043,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -186644,15 +190078,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -186661,7 +190096,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -186770,8 +190206,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -186823,8 +190259,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -186838,8 +190274,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -186894,7 +190330,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -186933,8 +190370,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -187145,10 +190582,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -187227,17 +190665,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -187249,7 +190687,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -187269,9 +190707,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -187279,10 +190719,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -187325,7 +190766,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -187406,11 +190847,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -187459,22 +190901,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -187487,14 +190931,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -187518,7 +190963,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -187585,10 +191030,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -187596,7 +191041,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -187624,15 +191076,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -187641,7 +191094,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -187750,8 +191204,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -187803,8 +191257,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -187818,8 +191272,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -187874,7 +191328,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -187913,8 +191368,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -188125,10 +191580,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -188207,17 +191663,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -188229,7 +191685,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -188249,9 +191705,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -188259,10 +191717,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -188305,7 +191764,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -188386,11 +191845,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -188439,22 +191899,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -188467,14 +191929,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -188498,7 +191961,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -188565,10 +192028,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -188576,7 +192039,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -188604,15 +192074,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -188621,7 +192092,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -188730,8 +192202,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -188783,8 +192255,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -188798,8 +192270,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -188854,7 +192326,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -188893,8 +192366,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -189105,10 +192578,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -189187,17 +192661,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -189209,7 +192683,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -189229,9 +192703,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -189239,10 +192715,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -189285,7 +192762,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -189366,11 +192843,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -189419,22 +192897,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -189447,14 +192927,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -189478,7 +192959,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -189545,10 +193026,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -189556,7 +193037,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -189584,15 +193072,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -189601,7 +193090,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -189710,8 +193200,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -189763,8 +193253,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -189778,8 +193268,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -189834,7 +193324,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -189873,8 +193364,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -190085,10 +193576,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -190167,17 +193659,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -190189,7 +193681,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -190209,9 +193701,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -190219,10 +193713,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -190265,7 +193760,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -190346,11 +193841,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -190399,22 +193895,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -190427,14 +193925,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -190458,7 +193957,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -190525,10 +194024,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -190536,7 +194035,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -190564,15 +194070,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -190581,7 +194088,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -190690,8 +194198,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -190743,8 +194251,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -190758,8 +194266,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -190814,7 +194322,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -190853,8 +194362,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -191065,10 +194574,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -191147,17 +194657,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -191169,7 +194679,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -191189,9 +194699,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -191199,10 +194711,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -191245,7 +194758,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -191326,11 +194839,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -191379,22 +194893,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -191407,14 +194923,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -191438,7 +194955,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -191505,10 +195022,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -191516,7 +195033,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -191544,15 +195068,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -191561,7 +195086,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -191670,8 +195196,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -191723,8 +195249,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -191738,8 +195264,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -191794,7 +195320,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -191833,8 +195360,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -192045,10 +195572,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -192127,17 +195655,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -192149,7 +195677,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -192169,9 +195697,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -192179,10 +195709,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -192225,7 +195756,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -192306,11 +195837,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -192359,22 +195891,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -192387,14 +195921,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -192418,7 +195953,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -192485,10 +196020,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -192496,7 +196031,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -192524,15 +196066,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -192541,7 +196084,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -192650,8 +196194,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -192703,8 +196247,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -192718,8 +196262,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -192774,7 +196318,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -192813,8 +196358,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -193025,10 +196570,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -193107,17 +196653,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -193129,7 +196675,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -193149,9 +196695,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -193159,10 +196707,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -193205,7 +196754,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -193286,11 +196835,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -193339,22 +196889,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -193367,14 +196919,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -193398,7 +196951,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -193465,10 +197018,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -193476,7 +197029,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -193504,15 +197064,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -193521,7 +197082,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -193630,8 +197192,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -193683,8 +197245,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -193698,8 +197260,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -193754,7 +197316,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -193793,8 +197356,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -194005,10 +197568,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -194087,17 +197651,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -194109,7 +197673,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -194129,9 +197693,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -194139,10 +197705,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -194185,7 +197752,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -194266,11 +197833,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -194319,22 +197887,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -194347,14 +197917,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -194378,7 +197949,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -194445,10 +198016,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -194456,7 +198027,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -194484,15 +198062,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -194501,7 +198080,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -194610,8 +198190,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -194663,8 +198243,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -194678,8 +198258,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -194734,7 +198314,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -194773,8 +198354,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -194985,10 +198566,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -195067,17 +198649,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -195089,7 +198671,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -195109,9 +198691,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -195119,10 +198703,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -195165,7 +198750,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -195246,11 +198831,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -195299,22 +198885,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -195327,14 +198915,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -195358,7 +198947,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -195425,10 +199014,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -195436,7 +199025,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -195464,15 +199060,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -195481,7 +199078,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -195590,8 +199188,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -195643,8 +199241,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -195658,8 +199256,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -195714,7 +199312,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -195753,8 +199352,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -195965,10 +199564,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -196047,17 +199647,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -196069,7 +199669,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -196089,9 +199689,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -196099,10 +199701,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -196145,7 +199748,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -196226,11 +199829,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -196279,22 +199883,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -196307,14 +199913,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -196338,7 +199945,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -196405,10 +200012,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -196416,7 +200023,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -196444,15 +200058,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -196461,7 +200076,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -196570,8 +200186,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -196623,8 +200239,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -196638,8 +200254,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -196694,7 +200310,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -196733,8 +200350,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -196945,10 +200562,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -197027,17 +200645,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -197049,7 +200667,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -197069,9 +200687,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -197079,10 +200699,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -197125,7 +200746,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -197206,11 +200827,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -197259,22 +200881,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -197287,14 +200911,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -197318,7 +200943,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -197385,10 +201010,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -197396,7 +201021,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -197424,15 +201056,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -197441,7 +201074,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -197550,8 +201184,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -197603,8 +201237,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -197618,8 +201252,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -197674,7 +201308,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -197713,8 +201348,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -197925,10 +201560,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -198007,17 +201643,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -198029,7 +201665,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -198049,9 +201685,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -198059,10 +201697,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -198105,7 +201744,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -198186,11 +201825,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -198239,22 +201879,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -198267,14 +201909,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -198298,7 +201941,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -198365,10 +202008,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -198376,7 +202019,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -198404,15 +202054,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -198421,7 +202072,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -198530,8 +202182,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -198583,8 +202235,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -198598,8 +202250,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -198654,7 +202306,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -198693,8 +202346,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -198905,10 +202558,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -198987,17 +202641,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -199009,7 +202663,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -199029,9 +202683,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -199039,10 +202695,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -199085,7 +202742,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -199166,11 +202823,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -199219,22 +202877,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -199247,14 +202907,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -199278,7 +202939,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -199345,10 +203006,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -199356,7 +203017,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -199384,15 +203052,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -199401,7 +203070,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -199510,8 +203180,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -199563,8 +203233,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -199578,8 +203248,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -199634,7 +203304,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -199673,8 +203344,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -199885,10 +203556,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -199967,17 +203639,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -199989,7 +203661,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -200009,9 +203681,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -200019,10 +203693,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -200065,7 +203740,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -200146,11 +203821,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -200199,22 +203875,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -200227,14 +203905,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -200258,7 +203937,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -200325,10 +204004,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -200336,7 +204015,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -200364,15 +204050,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -200381,7 +204068,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -200490,8 +204178,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -200543,8 +204231,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -200558,8 +204246,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -200614,7 +204302,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -200653,8 +204342,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -200865,10 +204554,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -200947,17 +204637,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -200969,7 +204659,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -200989,9 +204679,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -200999,10 +204691,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -201045,7 +204738,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -201126,11 +204819,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -201179,22 +204873,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -201207,14 +204903,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -201238,7 +204935,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -201305,10 +205002,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -201316,7 +205013,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -201344,15 +205048,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -201361,7 +205066,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -201470,8 +205176,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -201523,8 +205229,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -201538,8 +205244,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -201594,7 +205300,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -201633,8 +205340,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -201845,10 +205552,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -201927,17 +205635,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -201949,7 +205657,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -201969,9 +205677,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -201979,10 +205689,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -202025,7 +205736,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -202106,11 +205817,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -202159,22 +205871,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -202187,14 +205901,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -202218,7 +205933,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -202285,10 +206000,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -202296,7 +206011,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -202324,15 +206046,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -202341,7 +206064,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -202450,8 +206174,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -202503,8 +206227,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -202518,8 +206242,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -202574,7 +206298,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -202613,8 +206338,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -202825,10 +206550,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -202907,17 +206633,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -202929,7 +206655,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -202949,9 +206675,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -202959,10 +206687,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -203005,7 +206734,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -203086,11 +206815,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -203139,22 +206869,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -203167,14 +206899,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -203198,7 +206931,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -203265,10 +206998,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -203276,7 +207009,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -203304,15 +207044,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -203321,7 +207062,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -203430,8 +207172,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -203483,8 +207225,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -203498,8 +207240,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -203554,7 +207296,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -203593,8 +207336,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -203805,10 +207548,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -203887,17 +207631,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -203909,7 +207653,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -203929,9 +207673,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -203939,10 +207685,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -203985,7 +207732,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -204066,11 +207813,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -204119,22 +207867,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -204147,14 +207897,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -204178,7 +207929,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -204245,10 +207996,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -204256,7 +208007,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -204284,15 +208042,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -204301,7 +208060,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -204410,8 +208170,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -204463,8 +208223,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -204478,8 +208238,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -204534,7 +208294,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -204573,8 +208334,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -204785,10 +208546,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -204867,17 +208629,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -204889,7 +208651,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -204909,9 +208671,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -204919,10 +208683,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -204965,7 +208730,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -205046,11 +208811,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -205099,22 +208865,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -205127,14 +208895,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -205158,7 +208927,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -205225,10 +208994,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -205236,7 +209005,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -205264,15 +209040,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -205281,7 +209058,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -205390,8 +209168,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -205443,8 +209221,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -205458,8 +209236,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -205514,7 +209292,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -205553,8 +209332,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -205765,10 +209544,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -205847,17 +209627,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -205869,7 +209649,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -205889,9 +209669,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -205899,10 +209681,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -205945,7 +209728,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -206026,11 +209809,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -206079,22 +209863,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -206107,14 +209893,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -206138,7 +209925,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -206205,10 +209992,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -206216,7 +210003,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -206244,15 +210038,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -206261,7 +210056,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -206370,8 +210166,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -206423,8 +210219,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -206438,8 +210234,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -206494,7 +210290,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -206533,8 +210330,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -206745,10 +210542,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -206827,17 +210625,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -206849,7 +210647,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -206869,9 +210667,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -206879,10 +210679,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -206925,7 +210726,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -207006,11 +210807,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -207059,22 +210861,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -207087,14 +210891,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -207118,7 +210923,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -207185,10 +210990,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -207196,7 +211001,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -207224,15 +211036,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -207241,7 +211054,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -207350,8 +211164,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -207403,8 +211217,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -207418,8 +211232,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -207474,7 +211288,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -207513,8 +211328,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -207725,10 +211540,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -207807,17 +211623,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -207829,7 +211645,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -207849,9 +211665,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -207859,10 +211677,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -207905,7 +211724,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -207986,11 +211805,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -208039,22 +211859,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -208067,14 +211889,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -208098,7 +211921,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -208165,10 +211988,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -208176,7 +211999,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -208204,15 +212034,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -208221,7 +212052,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -208330,8 +212162,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -208383,8 +212215,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -208398,8 +212230,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -208454,7 +212286,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -208493,8 +212326,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -208705,10 +212538,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -208787,17 +212621,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -208809,7 +212643,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -208829,9 +212663,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -208839,10 +212675,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -208885,7 +212722,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -208966,11 +212803,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -209019,22 +212857,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -209047,14 +212887,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -209078,7 +212919,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -209145,10 +212986,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -209156,7 +212997,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -209184,15 +213032,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -209201,7 +213050,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -209310,8 +213160,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -209363,8 +213213,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -209378,8 +213228,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -209434,7 +213284,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -209473,8 +213324,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -209685,10 +213536,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -209767,17 +213619,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -209789,7 +213641,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -209809,9 +213661,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -209819,10 +213673,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -209865,7 +213720,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -209946,11 +213801,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -209999,22 +213855,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -210027,14 +213885,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -210058,7 +213917,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -210125,10 +213984,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -210136,7 +213995,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -210164,15 +214030,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -210181,7 +214048,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -210290,8 +214158,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -210343,8 +214211,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -210358,8 +214226,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -210414,7 +214282,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -210453,8 +214322,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -210665,10 +214534,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -210747,17 +214617,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -210769,7 +214639,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -210789,9 +214659,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -210799,10 +214671,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -210845,7 +214718,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -210926,11 +214799,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -210979,22 +214853,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -211007,14 +214883,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -211038,7 +214915,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -211105,10 +214982,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -211116,7 +214993,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -211144,15 +215028,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -211161,7 +215046,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -211270,8 +215156,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -211323,8 +215209,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -211338,8 +215224,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -211394,7 +215280,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -211433,8 +215320,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -211645,10 +215532,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -211727,17 +215615,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -211749,7 +215637,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -211769,9 +215657,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -211779,10 +215669,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -211825,7 +215716,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -211906,11 +215797,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -211959,22 +215851,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -211987,14 +215881,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -212018,7 +215913,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -212085,10 +215980,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -212096,7 +215991,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -212124,15 +216026,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -212141,7 +216044,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -212250,8 +216154,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -212303,8 +216207,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -212318,8 +216222,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -212374,7 +216278,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -212413,8 +216318,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -212625,10 +216530,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -212707,17 +216613,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -212729,7 +216635,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -212749,9 +216655,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -212759,10 +216667,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -212805,7 +216714,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -212886,11 +216795,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -212939,22 +216849,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -212967,14 +216879,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -212998,7 +216911,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -213065,10 +216978,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -213076,7 +216989,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -213104,15 +217024,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -213121,7 +217042,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -213230,8 +217152,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -213283,8 +217205,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -213298,8 +217220,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -213354,7 +217276,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -213393,8 +217316,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -213605,10 +217528,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -213687,17 +217611,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -213709,7 +217633,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -213729,9 +217653,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -213739,10 +217665,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -213785,7 +217712,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -213866,11 +217793,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -213919,22 +217847,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -213947,14 +217877,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -213978,7 +217909,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -214045,10 +217976,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -214056,7 +217987,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -214084,15 +218022,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -214101,7 +218040,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -214210,8 +218150,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -214263,8 +218203,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -214278,8 +218218,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -214334,7 +218274,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -214373,8 +218314,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -214585,10 +218526,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -214667,17 +218609,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -214689,7 +218631,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -214709,9 +218651,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -214719,10 +218663,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -214765,7 +218710,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -214846,11 +218791,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -214899,22 +218845,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -214927,14 +218875,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -214958,7 +218907,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -215025,10 +218974,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -215036,7 +218985,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -215064,15 +219020,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -215081,7 +219038,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -215190,8 +219148,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -215243,8 +219201,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -215258,8 +219216,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -215314,7 +219272,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -215353,8 +219312,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -215565,10 +219524,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -215647,17 +219607,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -215669,7 +219629,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -215689,9 +219649,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -215699,10 +219661,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -215745,7 +219708,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -215826,11 +219789,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -215879,22 +219843,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -215907,14 +219873,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -215938,7 +219905,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -216005,10 +219972,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -216016,7 +219983,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -216044,15 +220018,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -216061,7 +220036,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -216170,8 +220146,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -216223,8 +220199,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -216238,8 +220214,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -216294,7 +220270,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -216333,8 +220310,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -216545,10 +220522,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -216627,17 +220605,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -216649,7 +220627,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -216669,9 +220647,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -216679,10 +220659,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -216725,7 +220706,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -216806,11 +220787,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -216859,22 +220841,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -216887,14 +220871,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -216918,7 +220903,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -216985,10 +220970,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -216996,7 +220981,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -217024,15 +221016,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -217041,7 +221034,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -217150,8 +221144,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -217203,8 +221197,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -217218,8 +221212,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -217274,7 +221268,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -217313,8 +221308,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -217525,10 +221520,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -217607,17 +221603,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -217629,7 +221625,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -217649,9 +221645,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -217659,10 +221657,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -217705,7 +221704,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -217786,11 +221785,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -217839,22 +221839,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -217867,14 +221869,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -217898,7 +221901,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -217965,10 +221968,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -217976,7 +221979,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -218004,15 +222014,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -218021,7 +222032,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -218130,8 +222142,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -218183,8 +222195,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -218198,8 +222210,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -218254,7 +222266,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -218293,8 +222306,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -218505,10 +222518,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -218587,17 +222601,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -218609,7 +222623,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -218629,9 +222643,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -218639,10 +222655,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -218685,7 +222702,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -218766,11 +222783,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -218819,22 +222837,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -218847,14 +222867,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -218878,7 +222899,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -218945,10 +222966,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -218956,7 +222977,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -218984,15 +223012,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -219001,7 +223030,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -219110,8 +223140,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -219163,8 +223193,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -219178,8 +223208,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -219234,7 +223264,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -219273,8 +223304,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -219485,10 +223516,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -219567,17 +223599,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -219589,7 +223621,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -219609,9 +223641,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -219619,10 +223653,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -219665,7 +223700,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -219746,11 +223781,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -219799,22 +223835,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -219827,14 +223865,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -219858,7 +223897,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -219925,10 +223964,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -219936,7 +223975,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -219964,15 +224010,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -219981,7 +224028,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -220090,8 +224138,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -220143,8 +224191,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -220158,8 +224206,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -220214,7 +224262,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -220253,8 +224302,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -220465,10 +224514,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -220547,17 +224597,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -220569,7 +224619,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -220589,9 +224639,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -220599,10 +224651,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -220645,7 +224698,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -220726,11 +224779,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -220779,22 +224833,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -220807,14 +224863,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -220838,7 +224895,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -220905,10 +224962,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -220916,7 +224973,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -220944,15 +225008,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -220961,7 +225026,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -221070,8 +225136,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -221123,8 +225189,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -221138,8 +225204,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -221194,7 +225260,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -221233,8 +225300,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -221445,10 +225512,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -221527,17 +225595,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -221549,7 +225617,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -221569,9 +225637,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -221579,10 +225649,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -221625,7 +225696,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -221706,11 +225777,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -221759,22 +225831,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -221787,14 +225861,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -221818,7 +225893,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -221885,10 +225960,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -221896,7 +225971,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -221924,15 +226006,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -221941,7 +226024,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -222050,8 +226134,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -222103,8 +226187,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -222118,8 +226202,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -222174,7 +226258,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -222213,8 +226298,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -222425,10 +226510,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -222507,17 +226593,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -222529,7 +226615,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -222549,9 +226635,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -222559,10 +226647,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -222605,7 +226694,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -222686,11 +226775,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -222739,22 +226829,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -222767,14 +226859,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -222798,7 +226891,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -222865,10 +226958,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -222876,7 +226969,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -222904,15 +227004,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -222921,7 +227022,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -223030,8 +227132,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -223083,8 +227185,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -223098,8 +227200,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -223154,7 +227256,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -223193,8 +227296,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -223405,10 +227508,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -223487,17 +227591,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -223509,7 +227613,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -223529,9 +227633,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -223539,10 +227645,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -223585,7 +227692,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -223666,11 +227773,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -223719,22 +227827,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -223747,14 +227857,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -223778,7 +227889,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -223845,10 +227956,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -223856,7 +227967,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -223884,15 +228002,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -223901,7 +228020,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -224010,8 +228130,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -224063,8 +228183,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -224078,8 +228198,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -224134,7 +228254,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -224173,8 +228294,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -224385,10 +228506,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -224467,17 +228589,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -224489,7 +228611,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -224509,9 +228631,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -224519,10 +228643,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -224565,7 +228690,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -224646,11 +228771,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -224699,22 +228825,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -224727,14 +228855,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -224758,7 +228887,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -224825,10 +228954,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -224836,7 +228965,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -224864,15 +229000,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -224881,7 +229018,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -224990,8 +229128,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -225043,8 +229181,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -225058,8 +229196,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -225114,7 +229252,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -225153,8 +229292,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -225365,10 +229504,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -225447,17 +229587,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -225469,7 +229609,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -225489,9 +229629,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -225499,10 +229641,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -225545,7 +229688,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -225626,11 +229769,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -225679,22 +229823,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -225707,14 +229853,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -225738,7 +229885,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -225805,10 +229952,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -225816,7 +229963,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -225844,15 +229998,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -225861,7 +230016,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -225970,8 +230126,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -226023,8 +230179,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -226038,8 +230194,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -226094,7 +230250,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -226133,8 +230290,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -226345,10 +230502,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -226427,17 +230585,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -226449,7 +230607,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -226469,9 +230627,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -226479,10 +230639,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -226525,7 +230686,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -226606,11 +230767,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -226659,22 +230821,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -226687,14 +230851,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -226718,7 +230883,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -226785,10 +230950,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -226796,7 +230961,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -226824,15 +230996,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -226841,7 +231014,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -226950,8 +231124,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -227003,8 +231177,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -227018,8 +231192,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -227074,7 +231248,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -227113,8 +231288,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -227325,10 +231500,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -227407,17 +231583,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -227429,7 +231605,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -227449,9 +231625,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -227459,10 +231637,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -227505,7 +231684,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -227586,11 +231765,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -227639,22 +231819,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -227667,14 +231849,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -227698,7 +231881,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -227765,10 +231948,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -227776,7 +231959,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -227804,15 +231994,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -227821,7 +232012,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -227930,8 +232122,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -227983,8 +232175,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -227998,8 +232190,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -228054,7 +232246,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -228093,8 +232286,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -228305,10 +232498,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -228387,17 +232581,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -228409,7 +232603,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -228429,9 +232623,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -228439,10 +232635,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -228485,7 +232682,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -228566,11 +232763,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -228619,22 +232817,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -228647,14 +232847,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -228678,7 +232879,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -228745,10 +232946,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -228756,7 +232957,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -228784,15 +232992,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -228801,7 +233010,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -228910,8 +233120,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -228963,8 +233173,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -228978,8 +233188,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -229034,7 +233244,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -229073,8 +233284,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -229285,10 +233496,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -229367,17 +233579,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -229389,7 +233601,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -229409,9 +233621,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -229419,10 +233633,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -229465,7 +233680,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -229546,11 +233761,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -229599,22 +233815,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -229627,14 +233845,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -229658,7 +233877,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -229725,10 +233944,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -229736,7 +233955,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -229764,15 +233990,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -229781,7 +234008,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -229890,8 +234118,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -229943,8 +234171,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -229958,8 +234186,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -230014,7 +234242,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -230053,8 +234282,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -230265,10 +234494,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -230347,17 +234577,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -230369,7 +234599,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -230389,9 +234619,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -230399,10 +234631,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -230445,7 +234678,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -230526,11 +234759,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -230579,22 +234813,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -230607,14 +234843,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -230638,7 +234875,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -230705,10 +234942,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -230716,7 +234953,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -230744,15 +234988,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -230761,7 +235006,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -230870,8 +235116,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -230923,8 +235169,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -230938,8 +235184,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -230994,7 +235240,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -231033,8 +235280,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -231245,10 +235492,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -231327,17 +235575,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -231349,7 +235597,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -231369,9 +235617,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -231379,10 +235629,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -231425,7 +235676,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -231506,11 +235757,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -231559,22 +235811,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -231587,14 +235841,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -231618,7 +235873,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -231685,10 +235940,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -231696,7 +235951,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -231724,15 +235986,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -231741,7 +236004,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -231850,8 +236114,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -231903,8 +236167,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -231918,8 +236182,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -231974,7 +236238,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -232013,8 +236278,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -232225,10 +236490,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -232307,17 +236573,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -232329,7 +236595,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -232349,9 +236615,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -232359,10 +236627,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -232405,7 +236674,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -232486,11 +236755,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -232539,22 +236809,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -232567,14 +236839,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -232598,7 +236871,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -232665,10 +236938,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -232676,7 +236949,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -232704,15 +236984,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -232721,7 +237002,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -232830,8 +237112,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -232883,8 +237165,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -232898,8 +237180,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -232954,7 +237236,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -232993,8 +237276,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -233205,10 +237488,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -233287,17 +237571,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -233309,7 +237593,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -233329,9 +237613,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -233339,10 +237625,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -233385,7 +237672,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -233466,11 +237753,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -233519,22 +237807,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -233547,14 +237837,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -233578,7 +237869,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -233645,10 +237936,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -233656,7 +237947,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -233684,15 +237982,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -233701,7 +238000,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -233810,8 +238110,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -233863,8 +238163,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -233878,8 +238178,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -233934,7 +238234,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -233973,8 +238274,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -234185,10 +238486,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -234267,17 +238569,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -234289,7 +238591,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -234309,9 +238611,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -234319,10 +238623,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -234365,7 +238670,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -234446,11 +238751,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -234499,22 +238805,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -234527,14 +238835,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -234558,7 +238867,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -234625,10 +238934,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -234636,7 +238945,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -234664,15 +238980,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -234681,7 +238998,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -234790,8 +239108,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -234843,8 +239161,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -234858,8 +239176,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -234914,7 +239232,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -234953,8 +239272,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -235165,10 +239484,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -235247,17 +239567,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -235269,7 +239589,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -235289,9 +239609,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -235299,10 +239621,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -235345,7 +239668,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -235426,11 +239749,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -235479,22 +239803,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -235507,14 +239833,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -235538,7 +239865,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -235605,10 +239932,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -235616,7 +239943,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -235644,15 +239978,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -235661,7 +239996,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -235770,8 +240106,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -235823,8 +240159,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -235838,8 +240174,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -235894,7 +240230,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -235933,8 +240270,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -236145,10 +240482,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -236227,17 +240565,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -236249,7 +240587,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -236269,9 +240607,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -236279,10 +240619,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -236325,7 +240666,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -236406,11 +240747,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -236459,22 +240801,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -236487,14 +240831,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -236518,7 +240863,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -236585,10 +240930,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -236596,7 +240941,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -236624,15 +240976,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -236641,7 +240994,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -236750,8 +241104,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -236803,8 +241157,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -236818,8 +241172,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -236874,7 +241228,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -236913,8 +241268,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -237125,10 +241480,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -237207,17 +241563,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -237229,7 +241585,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -237249,9 +241605,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -237259,10 +241617,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -237305,7 +241664,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -237386,11 +241745,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -237439,22 +241799,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -237467,14 +241829,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -237498,7 +241861,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -237565,10 +241928,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -237576,7 +241939,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -237604,15 +241974,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -237621,7 +241992,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -237730,8 +242102,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -237783,8 +242155,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -237798,8 +242170,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -237854,7 +242226,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -237893,8 +242266,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -238105,10 +242478,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -238187,17 +242561,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -238209,7 +242583,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -238229,9 +242603,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -238239,10 +242615,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -238285,7 +242662,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -238366,11 +242743,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -238419,22 +242797,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -238447,14 +242827,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -238478,7 +242859,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -238545,10 +242926,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -238556,7 +242937,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -238584,15 +242972,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -238601,7 +242990,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -238710,8 +243100,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -238763,8 +243153,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -238778,8 +243168,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -238834,7 +243224,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -238873,8 +243264,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -239085,10 +243476,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -239167,17 +243559,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -239189,7 +243581,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -239209,9 +243601,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -239219,10 +243613,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -239265,7 +243660,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -239346,11 +243741,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -239399,22 +243795,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -239427,14 +243825,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -239458,7 +243857,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -239525,10 +243924,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -239536,7 +243935,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -239564,15 +243970,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -239581,7 +243988,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -239690,8 +244098,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -239743,8 +244151,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -239758,8 +244166,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -239814,7 +244222,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -239853,8 +244262,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -240065,10 +244474,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -240147,17 +244557,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -240169,7 +244579,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -240189,9 +244599,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -240199,10 +244611,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -240245,7 +244658,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -240326,11 +244739,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -240379,22 +244793,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -240407,14 +244823,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -240438,7 +244855,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -240505,10 +244922,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -240516,7 +244933,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -240544,15 +244968,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -240561,7 +244986,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -240670,8 +245096,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -240723,8 +245149,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -240738,8 +245164,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -240794,7 +245220,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -240833,8 +245260,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -241045,10 +245472,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -241127,17 +245555,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -241149,7 +245577,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -241169,9 +245597,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -241179,10 +245609,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -241225,7 +245656,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -241306,11 +245737,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -241359,22 +245791,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -241387,14 +245821,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -241418,7 +245853,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -241485,10 +245920,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -241496,7 +245931,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -241524,15 +245966,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -241541,7 +245984,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -241650,8 +246094,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -241703,8 +246147,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -241718,8 +246162,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -241774,7 +246218,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -241813,8 +246258,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -242025,10 +246470,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -242107,17 +246553,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -242129,7 +246575,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -242149,9 +246595,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -242159,10 +246607,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -242205,7 +246654,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -242286,11 +246735,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -242339,22 +246789,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -242367,14 +246819,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -242398,7 +246851,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -242465,10 +246918,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -242476,7 +246929,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -242504,15 +246964,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -242521,7 +246982,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -242630,8 +247092,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -242683,8 +247145,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -242698,8 +247160,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -242754,7 +247216,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -242793,8 +247256,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -243005,10 +247468,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -243087,17 +247551,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -243109,7 +247573,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -243129,9 +247593,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -243139,10 +247605,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -243185,7 +247652,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -243266,11 +247733,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -243319,22 +247787,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -243347,14 +247817,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -243378,7 +247849,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -243445,10 +247916,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -243456,7 +247927,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -243484,15 +247962,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -243501,7 +247980,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -243610,8 +248090,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -243663,8 +248143,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -243678,8 +248158,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -243734,7 +248214,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -243773,8 +248254,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -243985,10 +248466,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -244067,17 +248549,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -244089,7 +248571,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -244109,9 +248591,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -244119,10 +248603,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -244165,7 +248650,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -244246,11 +248731,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -244299,22 +248785,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -244327,14 +248815,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -244358,7 +248847,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -244425,10 +248914,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -244436,7 +248925,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -244464,15 +248960,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -244481,7 +248978,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -244590,8 +249088,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -244643,8 +249141,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -244658,8 +249156,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -244714,7 +249212,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -244753,8 +249252,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -244965,10 +249464,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -245047,17 +249547,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -245069,7 +249569,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -245089,9 +249589,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -245099,10 +249601,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -245145,7 +249648,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -245226,11 +249729,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -245279,22 +249783,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -245307,14 +249813,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -245338,7 +249845,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -245405,10 +249912,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -245416,7 +249923,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -245444,15 +249958,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -245461,7 +249976,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -245570,8 +250086,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -245623,8 +250139,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -245638,8 +250154,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -245694,7 +250210,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -245733,8 +250250,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -245945,10 +250462,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -246027,17 +250545,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -246049,7 +250567,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -246069,9 +250587,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -246079,10 +250599,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -246125,7 +250646,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -246206,11 +250727,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -246259,22 +250781,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -246287,14 +250811,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -246318,7 +250843,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -246385,10 +250910,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -246396,7 +250921,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -246424,15 +250956,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -246441,7 +250974,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -246550,8 +251084,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -246603,8 +251137,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -246618,8 +251152,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -246674,7 +251208,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -246713,8 +251248,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -246925,10 +251460,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -247007,17 +251543,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -247029,7 +251565,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -247049,9 +251585,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -247059,10 +251597,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -247105,7 +251644,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -247186,11 +251725,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -247239,22 +251779,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -247267,14 +251809,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -247298,7 +251841,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -247365,10 +251908,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -247376,7 +251919,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -247404,15 +251954,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -247421,7 +251972,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -247530,8 +252082,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -247583,8 +252135,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -247598,8 +252150,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -247654,7 +252206,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -247693,8 +252246,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -247905,10 +252458,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -247987,17 +252541,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -248009,7 +252563,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -248029,9 +252583,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -248039,10 +252595,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -248085,7 +252642,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -248166,11 +252723,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -248219,22 +252777,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -248247,14 +252807,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -248278,7 +252839,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -248345,10 +252906,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -248356,7 +252917,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -248384,15 +252952,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -248401,7 +252970,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -248510,8 +253080,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -248563,8 +253133,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -248578,8 +253148,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -248634,7 +253204,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -248673,8 +253244,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -248885,10 +253456,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -248967,17 +253539,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -248989,7 +253561,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -249009,9 +253581,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -249019,10 +253593,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -249065,7 +253640,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -249146,11 +253721,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -249199,22 +253775,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -249227,14 +253805,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -249258,7 +253837,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -249325,10 +253904,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -249336,7 +253915,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -249364,15 +253950,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -249381,7 +253968,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -249490,8 +254078,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -249543,8 +254131,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -249558,8 +254146,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -249614,7 +254202,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -249653,8 +254242,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -249865,10 +254454,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -249947,17 +254537,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -249969,7 +254559,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -249989,9 +254579,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -249999,10 +254591,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -250045,7 +254638,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -250126,11 +254719,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -250179,22 +254773,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -250207,14 +254803,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -250238,7 +254835,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -250305,10 +254902,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -250316,7 +254913,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -250344,15 +254948,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -250361,7 +254966,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -250470,8 +255076,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -250523,8 +255129,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -250538,8 +255144,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -250594,7 +255200,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -250633,8 +255240,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -250845,10 +255452,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -250927,17 +255535,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -250949,7 +255557,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -250969,9 +255577,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -250979,10 +255589,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -251025,7 +255636,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -251106,11 +255717,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -251159,22 +255771,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -251187,14 +255801,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -251218,7 +255833,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -251285,10 +255900,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -251296,7 +255911,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -251324,15 +255946,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -251341,7 +255964,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -251450,8 +256074,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -251503,8 +256127,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -251518,8 +256142,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -251574,7 +256198,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -251613,8 +256238,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -251825,10 +256450,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -251907,17 +256533,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -251929,7 +256555,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -251949,9 +256575,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -251959,10 +256587,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -252005,7 +256634,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -252086,11 +256715,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -252139,22 +256769,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -252167,14 +256799,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -252198,7 +256831,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -252265,10 +256898,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -252276,7 +256909,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -252304,15 +256944,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -252321,7 +256962,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -252430,8 +257072,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -252483,8 +257125,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -252498,8 +257140,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -252554,7 +257196,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -252593,8 +257236,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -252805,10 +257448,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -252887,17 +257531,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -252909,7 +257553,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -252929,9 +257573,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -252939,10 +257585,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -252985,7 +257632,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -253066,11 +257713,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -253119,22 +257767,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -253147,14 +257797,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -253178,7 +257829,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -253245,10 +257896,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -253256,7 +257907,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -253284,15 +257942,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -253301,7 +257960,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -253410,8 +258070,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -253463,8 +258123,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -253478,8 +258138,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -253534,7 +258194,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -253573,8 +258234,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -253785,10 +258446,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -253867,17 +258529,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -253889,7 +258551,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -253909,9 +258571,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -253919,10 +258583,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -253965,7 +258630,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -254046,11 +258711,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -254099,22 +258765,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -254127,14 +258795,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -254158,7 +258827,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -254225,10 +258894,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -254236,7 +258905,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -254264,15 +258940,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -254281,7 +258958,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -254390,8 +259068,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -254443,8 +259121,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -254458,8 +259136,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -254514,7 +259192,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -254553,8 +259232,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -254765,10 +259444,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -254847,17 +259527,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -254869,7 +259549,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -254889,9 +259569,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -254899,10 +259581,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -254945,7 +259628,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -255026,11 +259709,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -255079,22 +259763,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -255107,14 +259793,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -255138,7 +259825,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -255205,10 +259892,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -255216,7 +259903,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -255244,15 +259938,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -255261,7 +259956,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -255370,8 +260066,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -255423,8 +260119,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -255438,8 +260134,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -255494,7 +260190,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -255533,8 +260230,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -255745,10 +260442,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -255827,17 +260525,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -255849,7 +260547,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -255869,9 +260567,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -255879,10 +260579,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -255925,7 +260626,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -256006,11 +260707,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -256059,22 +260761,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -256087,14 +260791,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -256118,7 +260823,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -256185,10 +260890,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -256196,7 +260901,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -256224,15 +260936,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -256241,7 +260954,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -256350,8 +261064,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -256403,8 +261117,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -256418,8 +261132,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -256474,7 +261188,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -256513,8 +261228,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -256725,10 +261440,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -256807,17 +261523,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -256829,7 +261545,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -256849,9 +261565,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -256859,10 +261577,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -256905,7 +261624,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -256986,11 +261705,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -257039,22 +261759,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -257067,14 +261789,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -257098,7 +261821,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -257165,10 +261888,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -257176,7 +261899,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -257204,15 +261934,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -257221,7 +261952,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -257330,8 +262062,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -257383,8 +262115,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -257398,8 +262130,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -257454,7 +262186,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -257493,8 +262226,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -257705,10 +262438,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -257787,17 +262521,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -257809,7 +262543,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -257829,9 +262563,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -257839,10 +262575,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -257885,7 +262622,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -257966,11 +262703,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -258019,22 +262757,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -258047,14 +262787,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -258078,7 +262819,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -258145,10 +262886,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -258156,7 +262897,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -258184,15 +262932,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -258201,7 +262950,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -258310,8 +263060,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -258363,8 +263113,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -258378,8 +263128,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -258434,7 +263184,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -258473,8 +263224,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -258685,10 +263436,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -258767,17 +263519,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -258789,7 +263541,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -258809,9 +263561,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -258819,10 +263573,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -258865,7 +263620,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -258946,11 +263701,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -258999,22 +263755,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -259027,14 +263785,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -259058,7 +263817,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -259125,10 +263884,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -259136,7 +263895,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -259164,15 +263930,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -259181,7 +263948,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -259290,8 +264058,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -259343,8 +264111,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -259358,8 +264126,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -259414,7 +264182,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -259453,8 +264222,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -259665,10 +264434,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -259747,17 +264517,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -259769,7 +264539,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -259789,9 +264559,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -259799,10 +264571,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -259845,7 +264618,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -259926,11 +264699,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -259979,22 +264753,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -260007,14 +264783,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -260038,7 +264815,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -260105,10 +264882,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -260116,7 +264893,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -260144,15 +264928,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -260161,7 +264946,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -260270,8 +265056,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -260323,8 +265109,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -260338,8 +265124,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -260394,7 +265180,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -260433,8 +265220,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -260645,10 +265432,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -260727,17 +265515,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -260749,7 +265537,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -260769,9 +265557,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -260779,10 +265569,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -260825,7 +265616,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -260906,11 +265697,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -260959,22 +265751,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -260987,14 +265781,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -261018,7 +265813,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -261085,10 +265880,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -261096,7 +265891,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -261124,15 +265926,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -261141,7 +265944,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -261250,8 +266054,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -261303,8 +266107,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -261318,8 +266122,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -261374,7 +266178,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -261413,8 +266218,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -261625,10 +266430,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -261707,17 +266513,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -261729,7 +266535,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -261749,9 +266555,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -261759,10 +266567,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -261805,7 +266614,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -261886,11 +266695,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -261939,22 +266749,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -261967,14 +266779,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -261998,7 +266811,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -262065,10 +266878,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -262076,7 +266889,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -262104,15 +266924,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -262121,7 +266942,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -262230,8 +267052,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -262283,8 +267105,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -262298,8 +267120,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -262354,7 +267176,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -262393,8 +267216,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -262605,10 +267428,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -262687,17 +267511,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -262709,7 +267533,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -262729,9 +267553,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -262739,10 +267565,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -262785,7 +267612,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -262866,11 +267693,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -262919,22 +267747,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -262947,14 +267777,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -262978,7 +267809,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -263045,10 +267876,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -263056,7 +267887,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -263084,15 +267922,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -263101,7 +267940,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -263210,8 +268050,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -263263,8 +268103,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -263278,8 +268118,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -263334,7 +268174,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -263373,8 +268214,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -263585,10 +268426,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -263667,17 +268509,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -263689,7 +268531,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -263709,9 +268551,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -263719,10 +268563,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -263765,7 +268610,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -263846,11 +268691,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -263899,22 +268745,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -263927,14 +268775,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -263958,7 +268807,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -264025,10 +268874,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -264036,7 +268885,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -264064,15 +268920,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -264081,7 +268938,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -264190,8 +269048,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -264243,8 +269101,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -264258,8 +269116,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -264314,7 +269172,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -264353,8 +269212,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -264565,10 +269424,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -264647,17 +269507,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -264669,7 +269529,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -264689,9 +269549,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -264699,10 +269561,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -264745,7 +269608,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -264826,11 +269689,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -264879,22 +269743,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -264907,14 +269773,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -264938,7 +269805,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -265005,10 +269872,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -265016,7 +269883,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -265044,15 +269918,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -265061,7 +269936,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -265170,8 +270046,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -265223,8 +270099,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -265238,8 +270114,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -265294,7 +270170,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -265333,8 +270210,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -265545,10 +270422,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -265627,17 +270505,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -265649,7 +270527,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -265669,9 +270547,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -265679,10 +270559,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -265725,7 +270606,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -265806,11 +270687,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -265859,22 +270741,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -265887,14 +270771,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -265918,7 +270803,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -265985,10 +270870,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -265996,7 +270881,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -266024,15 +270916,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -266041,7 +270934,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -266150,8 +271044,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -266203,8 +271097,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -266218,8 +271112,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -266274,7 +271168,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -266313,8 +271208,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -266525,10 +271420,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -266607,17 +271503,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -266629,7 +271525,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -266649,9 +271545,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -266659,10 +271557,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -266705,7 +271604,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -266786,11 +271685,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -266839,22 +271739,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -266867,14 +271769,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -266898,7 +271801,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -266965,10 +271868,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -266976,7 +271879,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -267004,15 +271914,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -267021,7 +271932,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -267130,8 +272042,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -267183,8 +272095,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -267198,8 +272110,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -267254,7 +272166,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -267293,8 +272206,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -267505,10 +272418,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -267587,17 +272501,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -267609,7 +272523,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -267629,9 +272543,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -267639,10 +272555,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -267685,7 +272602,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -267766,11 +272683,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -267819,22 +272737,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -267847,14 +272767,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -267878,7 +272799,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -267945,10 +272866,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -267956,7 +272877,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -267984,15 +272912,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -268001,7 +272930,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -268110,8 +273040,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -268163,8 +273093,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -268178,8 +273108,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -268234,7 +273164,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -268273,8 +273204,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -268485,10 +273416,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -268567,17 +273499,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -268589,7 +273521,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -268609,9 +273541,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -268619,10 +273553,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -268665,7 +273600,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -268746,11 +273681,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -268799,22 +273735,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -268827,14 +273765,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -268858,7 +273797,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -268925,10 +273864,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -268936,7 +273875,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -268964,15 +273910,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -268981,7 +273928,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -269090,8 +274038,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -269143,8 +274091,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -269158,8 +274106,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -269214,7 +274162,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -269253,8 +274202,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -269465,10 +274414,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -269547,17 +274497,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -269569,7 +274519,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -269589,9 +274539,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -269599,10 +274551,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -269645,7 +274598,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -269726,11 +274679,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -269779,22 +274733,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -269807,14 +274763,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -269838,7 +274795,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -269905,10 +274862,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -269916,7 +274873,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -269944,15 +274908,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -269961,7 +274926,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -270070,8 +275036,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -270123,8 +275089,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -270138,8 +275104,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -270194,7 +275160,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -270233,8 +275200,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -270445,10 +275412,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -270527,17 +275495,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -270549,7 +275517,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -270569,9 +275537,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -270579,10 +275549,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -270625,7 +275596,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -270706,11 +275677,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -270759,22 +275731,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -270787,14 +275761,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -270818,7 +275793,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -270885,10 +275860,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -270896,7 +275871,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -270924,15 +275906,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -270941,7 +275924,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -271050,8 +276034,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -271103,8 +276087,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -271118,8 +276102,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -271174,7 +276158,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -271213,8 +276198,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -271425,10 +276410,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -271507,17 +276493,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -271529,7 +276515,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -271549,9 +276535,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -271559,10 +276547,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -271605,7 +276594,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -271686,11 +276675,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -271739,22 +276729,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -271767,14 +276759,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -271798,7 +276791,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -271865,10 +276858,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -271876,7 +276869,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -271904,15 +276904,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -271921,7 +276922,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -272030,8 +277032,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -272083,8 +277085,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -272098,8 +277100,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -272154,7 +277156,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -272193,8 +277196,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -272405,10 +277408,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -272487,17 +277491,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -272509,7 +277513,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -272529,9 +277533,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -272539,10 +277545,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -272585,7 +277592,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -272666,11 +277673,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -272719,22 +277727,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -272747,14 +277757,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -272778,7 +277789,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -272845,10 +277856,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -272856,7 +277867,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -272884,15 +277902,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -272901,7 +277920,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -273010,8 +278030,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -273063,8 +278083,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -273078,8 +278098,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -273134,7 +278154,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -273173,8 +278194,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -273385,10 +278406,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -273467,17 +278489,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -273489,7 +278511,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -273509,9 +278531,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -273519,10 +278543,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -273565,7 +278590,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -273646,11 +278671,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -273699,22 +278725,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -273727,14 +278755,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -273758,7 +278787,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -273825,10 +278854,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -273836,7 +278865,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -273864,15 +278900,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -273881,7 +278918,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -273990,8 +279028,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -274043,8 +279081,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -274058,8 +279096,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -274114,7 +279152,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -274153,8 +279192,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -274365,10 +279404,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -274447,17 +279487,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -274469,7 +279509,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -274489,9 +279529,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -274499,10 +279541,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -274545,7 +279588,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -274626,11 +279669,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -274679,22 +279723,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -274707,14 +279753,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -274738,7 +279785,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -274805,10 +279852,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -274816,7 +279863,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -274844,15 +279898,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -274861,7 +279916,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -274970,8 +280026,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -275023,8 +280079,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -275038,8 +280094,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -275094,7 +280150,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -275133,8 +280190,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -275345,10 +280402,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -275427,17 +280485,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -275449,7 +280507,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -275469,9 +280527,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -275479,10 +280539,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -275525,7 +280586,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -275606,11 +280667,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -275659,22 +280721,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -275687,14 +280751,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -275718,7 +280783,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -275785,10 +280850,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -275796,7 +280861,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -275824,15 +280896,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -275841,7 +280914,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -275950,8 +281024,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -276003,8 +281077,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -276018,8 +281092,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -276074,7 +281148,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -276113,8 +281188,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -276325,10 +281400,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -276407,17 +281483,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -276429,7 +281505,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -276449,9 +281525,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -276459,10 +281537,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -276505,7 +281584,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -276586,11 +281665,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -276639,22 +281719,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -276667,14 +281749,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -276698,7 +281781,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -276765,10 +281848,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -276776,7 +281859,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -276804,15 +281894,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -276821,7 +281912,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -276930,8 +282022,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -276983,8 +282075,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -276998,8 +282090,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -277054,7 +282146,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -277093,8 +282186,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -277305,10 +282398,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -277387,17 +282481,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -277409,7 +282503,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -277429,9 +282523,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -277439,10 +282535,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -277485,7 +282582,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -277566,11 +282663,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -277619,22 +282717,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -277647,14 +282747,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -277678,7 +282779,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -277745,10 +282846,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -277756,7 +282857,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -277784,15 +282892,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -277801,7 +282910,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -277910,8 +283020,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -277963,8 +283073,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -277978,8 +283088,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -278034,7 +283144,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -278073,8 +283184,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -278285,10 +283396,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -278367,17 +283479,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -278389,7 +283501,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -278409,9 +283521,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -278419,10 +283533,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -278465,7 +283580,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -278546,11 +283661,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -278599,22 +283715,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -278627,14 +283745,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -278658,7 +283777,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -278725,10 +283844,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -278736,7 +283855,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -278764,15 +283890,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -278781,7 +283908,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -278890,8 +284018,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -278943,8 +284071,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -278958,8 +284086,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -279014,7 +284142,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -279053,8 +284182,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -279265,10 +284394,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -279347,17 +284477,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -279369,7 +284499,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -279389,9 +284519,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -279399,10 +284531,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -279445,7 +284578,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -279526,11 +284659,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -279579,22 +284713,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -279607,14 +284743,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -279638,7 +284775,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -279705,10 +284842,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -279716,7 +284853,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -279744,15 +284888,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -279761,7 +284906,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -279870,8 +285016,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -279923,8 +285069,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -279938,8 +285084,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -279994,7 +285140,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -280033,8 +285180,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -280245,10 +285392,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -280327,17 +285475,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -280349,7 +285497,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -280369,9 +285517,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -280379,10 +285529,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -280425,7 +285576,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -280506,11 +285657,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -280559,22 +285711,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -280587,14 +285741,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -280618,7 +285773,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -280685,10 +285840,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -280696,7 +285851,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -280724,15 +285886,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -280741,7 +285904,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -280850,8 +286014,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -280903,8 +286067,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -280918,8 +286082,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -280974,7 +286138,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -281013,8 +286178,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -281225,10 +286390,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -281307,17 +286473,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -281329,7 +286495,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -281349,9 +286515,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -281359,10 +286527,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -281405,7 +286574,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -281486,11 +286655,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -281539,22 +286709,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -281567,14 +286739,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -281598,7 +286771,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -281665,10 +286838,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -281676,7 +286849,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -281704,15 +286884,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -281721,7 +286902,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -281830,8 +287012,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -281883,8 +287065,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -281898,8 +287080,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -281954,7 +287136,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -281993,8 +287176,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -282205,10 +287388,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -282287,17 +287471,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -282309,7 +287493,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -282329,9 +287513,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -282339,10 +287525,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -282385,7 +287572,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -282466,11 +287653,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -282519,22 +287707,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -282547,14 +287737,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -282578,7 +287769,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -282645,10 +287836,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -282656,7 +287847,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -282684,15 +287882,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -282701,7 +287900,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -282810,8 +288010,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -282863,8 +288063,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -282878,8 +288078,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -282934,7 +288134,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -282973,8 +288174,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -283185,10 +288386,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -283267,17 +288469,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -283289,7 +288491,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -283309,9 +288511,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -283319,10 +288523,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -283365,7 +288570,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -283446,11 +288651,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -283499,22 +288705,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -283527,14 +288735,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -283558,7 +288767,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -283625,10 +288834,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -283636,7 +288845,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -283664,15 +288880,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -283681,7 +288898,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -283790,8 +289008,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -283843,8 +289061,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -283858,8 +289076,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -283914,7 +289132,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -283953,8 +289172,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -284165,10 +289384,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -284247,17 +289467,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -284269,7 +289489,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -284289,9 +289509,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -284299,10 +289521,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -284345,7 +289568,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -284426,11 +289649,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -284479,22 +289703,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -284507,14 +289733,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -284538,7 +289765,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -284605,10 +289832,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -284616,7 +289843,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -284644,15 +289878,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -284661,7 +289896,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -284770,8 +290006,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -284823,8 +290059,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -284838,8 +290074,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -284894,7 +290130,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -284933,8 +290170,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -285145,10 +290382,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -285227,17 +290465,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -285249,7 +290487,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -285269,9 +290507,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -285279,10 +290519,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -285325,7 +290566,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -285406,11 +290647,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -285459,22 +290701,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -285487,14 +290731,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -285518,7 +290763,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -285585,10 +290830,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -285596,7 +290841,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -285624,15 +290876,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -285641,7 +290894,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -285750,8 +291004,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -285803,8 +291057,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -285818,8 +291072,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -285874,7 +291128,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -285913,8 +291168,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -286125,10 +291380,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -286207,17 +291463,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -286229,7 +291485,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -286249,9 +291505,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -286259,10 +291517,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -286305,7 +291564,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -286386,11 +291645,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -286439,22 +291699,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -286467,14 +291729,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -286498,7 +291761,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -286565,10 +291828,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -286576,7 +291839,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -286604,15 +291874,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -286621,7 +291892,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -286730,8 +292002,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -286783,8 +292055,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -286798,8 +292070,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -286854,7 +292126,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -286893,8 +292166,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -287105,10 +292378,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -287187,17 +292461,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -287209,7 +292483,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -287229,9 +292503,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -287239,10 +292515,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -287285,7 +292562,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -287366,11 +292643,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -287419,22 +292697,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -287447,14 +292727,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -287478,7 +292759,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -287545,10 +292826,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -287556,7 +292837,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -287584,15 +292872,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -287601,7 +292890,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -287710,8 +293000,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -287763,8 +293053,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -287778,8 +293068,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -287834,7 +293124,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -287873,8 +293164,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -288085,10 +293376,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -288167,17 +293459,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -288189,7 +293481,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -288209,9 +293501,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -288219,10 +293513,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -288265,7 +293560,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -288346,11 +293641,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -288399,22 +293695,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -288427,14 +293725,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -288458,7 +293757,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -288525,10 +293824,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -288536,7 +293835,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -288564,15 +293870,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -288581,7 +293888,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -288690,8 +293998,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -288743,8 +294051,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -288758,8 +294066,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -288814,7 +294122,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -288853,8 +294162,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -289065,10 +294374,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -289147,17 +294457,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -289169,7 +294479,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -289189,9 +294499,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -289199,10 +294511,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -289245,7 +294558,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -289326,11 +294639,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -289379,22 +294693,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -289407,14 +294723,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -289438,7 +294755,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -289505,10 +294822,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -289516,7 +294833,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -289544,15 +294868,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -289561,7 +294886,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -289670,8 +294996,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -289723,8 +295049,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -289738,8 +295064,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -289794,7 +295120,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -289833,8 +295160,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -290045,10 +295372,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -290127,17 +295455,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -290149,7 +295477,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -290169,9 +295497,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -290179,10 +295509,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -290225,7 +295556,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -290306,11 +295637,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -290359,22 +295691,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -290387,14 +295721,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -290418,7 +295753,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -290485,10 +295820,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -290496,7 +295831,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -290524,15 +295866,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -290541,7 +295884,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -290650,8 +295994,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -290703,8 +296047,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -290718,8 +296062,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -290774,7 +296118,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -290813,8 +296158,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -291025,10 +296370,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -291107,17 +296453,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -291129,7 +296475,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -291149,9 +296495,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -291159,10 +296507,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -291205,7 +296554,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -291286,11 +296635,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -291339,22 +296689,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -291367,14 +296719,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -291398,7 +296751,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -291465,10 +296818,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -291476,7 +296829,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -291504,15 +296864,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -291521,7 +296882,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -291630,8 +296992,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -291683,8 +297045,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -291698,8 +297060,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -291754,7 +297116,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -291793,8 +297156,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -292005,10 +297368,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -292087,17 +297451,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -292109,7 +297473,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -292129,9 +297493,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -292139,10 +297505,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -292185,7 +297552,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -292266,11 +297633,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -292319,22 +297687,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -292347,14 +297717,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -292378,7 +297749,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -292445,10 +297816,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -292456,7 +297827,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -292484,15 +297862,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -292501,7 +297880,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -292610,8 +297990,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -292663,8 +298043,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -292678,8 +298058,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -292734,7 +298114,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -292773,8 +298154,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -292985,10 +298366,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -293067,17 +298449,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -293089,7 +298471,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -293109,9 +298491,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -293119,10 +298503,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -293165,7 +298550,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -293246,11 +298631,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -293299,22 +298685,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -293327,14 +298715,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -293358,7 +298747,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -293425,10 +298814,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -293436,7 +298825,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -293464,15 +298860,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -293481,7 +298878,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -293590,8 +298988,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -293643,8 +299041,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -293658,8 +299056,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -293714,7 +299112,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -293753,8 +299152,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -293965,10 +299364,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -294047,17 +299447,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -294069,7 +299469,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -294089,9 +299489,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -294099,10 +299501,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -294145,7 +299548,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -294226,11 +299629,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -294279,22 +299683,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -294307,14 +299713,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -294338,7 +299745,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -294405,10 +299812,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -294416,7 +299823,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -294444,15 +299858,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -294461,7 +299876,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -294570,8 +299986,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -294623,8 +300039,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -294638,8 +300054,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -294694,7 +300110,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -294733,8 +300150,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -294945,10 +300362,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -295027,17 +300445,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -295049,7 +300467,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -295069,9 +300487,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -295079,10 +300499,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -295125,7 +300546,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -295206,11 +300627,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -295259,22 +300681,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -295287,14 +300711,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -295318,7 +300743,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -295385,10 +300810,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -295396,7 +300821,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -295424,15 +300856,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -295441,7 +300874,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -295550,8 +300984,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -295603,8 +301037,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -295618,8 +301052,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -295674,7 +301108,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -295713,8 +301148,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -295925,10 +301360,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -296007,17 +301443,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -296029,7 +301465,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -296049,9 +301485,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -296059,10 +301497,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -296105,7 +301544,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -296186,11 +301625,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -296239,22 +301679,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -296267,14 +301709,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -296298,7 +301741,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -296365,10 +301808,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -296376,7 +301819,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -296404,15 +301854,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -296421,7 +301872,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -296530,8 +301982,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -296583,8 +302035,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -296598,8 +302050,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -296654,7 +302106,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -296693,8 +302146,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -296905,10 +302358,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -296987,17 +302441,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -297009,7 +302463,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -297029,9 +302483,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -297039,10 +302495,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -297085,7 +302542,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -297166,11 +302623,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -297219,22 +302677,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -297247,14 +302707,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -297278,7 +302739,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -297345,10 +302806,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -297356,7 +302817,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -297384,15 +302852,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -297401,7 +302870,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -297510,8 +302980,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -297563,8 +303033,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -297578,8 +303048,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -297634,7 +303104,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -297673,8 +303144,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -297885,10 +303356,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -297967,17 +303439,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -297989,7 +303461,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -298009,9 +303481,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -298019,10 +303493,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -298065,7 +303540,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -298146,11 +303621,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -298199,22 +303675,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -298227,14 +303705,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -298258,7 +303737,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -298325,10 +303804,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -298336,7 +303815,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -298364,15 +303850,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -298381,7 +303868,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -298490,8 +303978,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -298543,8 +304031,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -298558,8 +304046,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -298614,7 +304102,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -298653,8 +304142,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -298865,10 +304354,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -298947,17 +304437,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -298969,7 +304459,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -298989,9 +304479,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -298999,10 +304491,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -299045,7 +304538,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -299126,11 +304619,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -299179,22 +304673,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -299207,14 +304703,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -299238,7 +304735,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -299305,10 +304802,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -299316,7 +304813,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -299344,15 +304848,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -299361,7 +304866,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -299470,8 +304976,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -299523,8 +305029,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -299538,8 +305044,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -299594,7 +305100,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -299633,8 +305140,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -299845,10 +305352,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -299927,17 +305435,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -299949,7 +305457,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -299969,9 +305477,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -299979,10 +305489,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -300025,7 +305536,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -300106,11 +305617,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -300159,22 +305671,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -300187,14 +305701,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -300218,7 +305733,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -300285,10 +305800,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -300296,7 +305811,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -300324,15 +305846,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -300341,7 +305864,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -300450,8 +305974,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -300503,8 +306027,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -300518,8 +306042,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -300574,7 +306098,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -300613,8 +306138,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -300825,10 +306350,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -300907,17 +306433,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -300929,7 +306455,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -300949,9 +306475,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -300959,10 +306487,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -301005,7 +306534,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -301086,11 +306615,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -301139,22 +306669,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -301167,14 +306699,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -301198,7 +306731,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -301265,10 +306798,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -301276,7 +306809,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -301304,15 +306844,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -301321,7 +306862,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -301430,8 +306972,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -301483,8 +307025,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -301498,8 +307040,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -301554,7 +307096,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -301593,8 +307136,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -301805,10 +307348,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -301887,17 +307431,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -301909,7 +307453,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -301929,9 +307473,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -301939,10 +307485,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -301985,7 +307532,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -302066,11 +307613,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -302119,22 +307667,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -302147,14 +307697,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -302178,7 +307729,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -302245,10 +307796,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -302256,7 +307807,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -302284,15 +307842,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -302301,7 +307860,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -302410,8 +307970,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -302463,8 +308023,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -302478,8 +308038,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -302534,7 +308094,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -302573,8 +308134,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -302785,10 +308346,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -302867,17 +308429,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -302889,7 +308451,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -302909,9 +308471,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -302919,10 +308483,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -302965,7 +308530,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -303046,11 +308611,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -303099,22 +308665,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -303127,14 +308695,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -303158,7 +308727,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -303225,10 +308794,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -303236,7 +308805,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -303264,15 +308840,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -303281,7 +308858,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -303390,8 +308968,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -303443,8 +309021,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -303458,8 +309036,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -303514,7 +309092,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -303553,8 +309132,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -303765,10 +309344,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -303847,17 +309427,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -303869,7 +309449,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -303889,9 +309469,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -303899,10 +309481,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -303945,7 +309528,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -304026,11 +309609,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -304079,22 +309663,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -304107,14 +309693,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -304138,7 +309725,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -304205,10 +309792,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -304216,7 +309803,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -304244,15 +309838,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -304261,7 +309856,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -304370,8 +309966,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -304423,8 +310019,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -304438,8 +310034,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -304494,7 +310090,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -304533,8 +310130,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -304745,10 +310342,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -304827,17 +310425,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -304849,7 +310447,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -304869,9 +310467,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -304879,10 +310479,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -304925,7 +310526,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -305006,11 +310607,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -305059,22 +310661,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -305087,14 +310691,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -305118,7 +310723,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -305185,10 +310790,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -305196,7 +310801,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -305224,15 +310836,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -305241,7 +310854,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -305350,8 +310964,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -305403,8 +311017,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -305418,8 +311032,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -305474,7 +311088,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -305513,8 +311128,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -305725,10 +311340,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -305807,17 +311423,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -305829,7 +311445,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -305849,9 +311465,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -305859,10 +311477,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -305905,7 +311524,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -305986,11 +311605,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -306039,22 +311659,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -306067,14 +311689,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -306098,7 +311721,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -306165,10 +311788,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -306176,7 +311799,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -306204,15 +311834,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -306221,7 +311852,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -306330,8 +311962,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -306383,8 +312015,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -306398,8 +312030,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -306454,7 +312086,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -306493,8 +312126,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -306705,10 +312338,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -306787,17 +312421,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -306809,7 +312443,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -306829,9 +312463,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -306839,10 +312475,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -306885,7 +312522,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -306966,11 +312603,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -307019,22 +312657,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -307047,14 +312687,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -307078,7 +312719,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -307145,10 +312786,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -307156,7 +312797,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -307184,15 +312832,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -307201,7 +312850,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -307310,8 +312960,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -307363,8 +313013,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -307378,8 +313028,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -307434,7 +313084,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -307473,8 +313124,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -307685,10 +313336,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -307767,17 +313419,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -307789,7 +313441,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -307809,9 +313461,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -307819,10 +313473,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -307865,7 +313520,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -307946,11 +313601,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -307999,22 +313655,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -308027,14 +313685,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -308058,7 +313717,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -308125,10 +313784,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -308136,7 +313795,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -308164,15 +313830,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -308181,7 +313848,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -308290,8 +313958,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -308343,8 +314011,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -308358,8 +314026,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -308414,7 +314082,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -308453,8 +314122,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -308665,10 +314334,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -308747,17 +314417,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -308769,7 +314439,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -308789,9 +314459,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -308799,10 +314471,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -308845,7 +314518,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -308926,11 +314599,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -308979,22 +314653,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -309007,14 +314683,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -309038,7 +314715,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -309105,10 +314782,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -309116,7 +314793,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -309144,15 +314828,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -309161,7 +314846,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -309270,8 +314956,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -309323,8 +315009,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -309338,8 +315024,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -309394,7 +315080,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -309433,8 +315120,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -309645,10 +315332,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -309727,17 +315415,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -309749,7 +315437,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -309769,9 +315457,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -309779,10 +315469,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -309825,7 +315516,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -309906,11 +315597,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -309959,22 +315651,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -309987,14 +315681,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -310018,7 +315713,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -310085,10 +315780,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -310096,7 +315791,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -310124,15 +315826,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -310141,7 +315844,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -310250,8 +315954,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -310303,8 +316007,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -310318,8 +316022,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -310374,7 +316078,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -310413,8 +316118,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -310625,10 +316330,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -310707,17 +316413,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -310729,7 +316435,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -310749,9 +316455,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -310759,10 +316467,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -310805,7 +316514,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -310886,11 +316595,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -310939,22 +316649,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -310967,14 +316679,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -310998,7 +316711,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -311065,10 +316778,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -311076,7 +316789,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -311104,15 +316824,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -311121,7 +316842,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -311230,8 +316952,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -311283,8 +317005,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -311298,8 +317020,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -311354,7 +317076,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -311393,8 +317116,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -311605,10 +317328,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -311687,17 +317411,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -311709,7 +317433,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -311729,9 +317453,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -311739,10 +317465,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -311785,7 +317512,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -311866,11 +317593,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -311919,22 +317647,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -311947,14 +317677,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -311978,7 +317709,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -312045,10 +317776,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -312056,7 +317787,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -312084,15 +317822,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -312101,7 +317840,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -312210,8 +317950,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -312263,8 +318003,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -312278,8 +318018,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -312334,7 +318074,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -312373,8 +318114,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -312585,10 +318326,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -312667,17 +318409,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -312689,7 +318431,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -312709,9 +318451,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -312719,10 +318463,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -312765,7 +318510,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -312846,11 +318591,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -312899,22 +318645,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -312927,14 +318675,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -312958,7 +318707,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -313025,10 +318774,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -313036,7 +318785,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -313064,15 +318820,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -313081,7 +318838,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -313190,8 +318948,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -313243,8 +319001,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -313258,8 +319016,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -313314,7 +319072,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -313353,8 +319112,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -313565,10 +319324,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -313647,17 +319407,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -313669,7 +319429,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -313689,9 +319449,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -313699,10 +319461,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -313745,7 +319508,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -313826,11 +319589,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -313879,22 +319643,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -313907,14 +319673,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -313938,7 +319705,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -314005,10 +319772,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -314016,7 +319783,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -314044,15 +319818,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -314061,7 +319836,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -314170,8 +319946,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -314223,8 +319999,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -314238,8 +320014,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -314294,7 +320070,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -314333,8 +320110,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -314545,10 +320322,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -314627,17 +320405,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -314649,7 +320427,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -314669,9 +320447,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -314679,10 +320459,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -314725,7 +320506,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -314806,11 +320587,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -314859,22 +320641,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -314887,14 +320671,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -314918,7 +320703,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -314985,10 +320770,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -314996,7 +320781,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -315024,15 +320816,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -315041,7 +320834,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -315150,8 +320944,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -315203,8 +320997,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -315218,8 +321012,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -315274,7 +321068,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -315313,8 +321108,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -315525,10 +321320,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -315607,17 +321403,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -315629,7 +321425,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -315649,9 +321445,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -315659,10 +321457,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -315705,7 +321504,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -315786,11 +321585,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -315839,22 +321639,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -315867,14 +321669,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -315898,7 +321701,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -315965,10 +321768,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -315976,7 +321779,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -316004,15 +321814,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -316021,7 +321832,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -316130,8 +321942,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -316183,8 +321995,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -316198,8 +322010,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -316254,7 +322066,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -316293,8 +322106,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -316505,10 +322318,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -316587,17 +322401,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -316609,7 +322423,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -316629,9 +322443,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -316639,10 +322455,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -316685,7 +322502,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -316766,11 +322583,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -316819,22 +322637,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -316847,14 +322667,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -316878,7 +322699,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -316945,10 +322766,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -316956,7 +322777,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -316984,15 +322812,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -317001,7 +322830,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -317110,8 +322940,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -317163,8 +322993,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -317178,8 +323008,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -317234,7 +323064,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -317273,8 +323104,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -317485,10 +323316,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -317567,17 +323399,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -317589,7 +323421,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -317609,9 +323441,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -317619,10 +323453,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -317665,7 +323500,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -317746,11 +323581,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -317799,22 +323635,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -317827,14 +323665,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -317858,7 +323697,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -317925,10 +323764,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -317936,7 +323775,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -317964,15 +323810,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -317981,7 +323828,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -318090,8 +323938,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -318143,8 +323991,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -318158,8 +324006,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -318214,7 +324062,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -318253,8 +324102,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -318465,10 +324314,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -318547,17 +324397,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -318569,7 +324419,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -318589,9 +324439,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -318599,10 +324451,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -318645,7 +324498,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -318726,11 +324579,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -318779,22 +324633,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -318807,14 +324663,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -318838,7 +324695,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -318905,10 +324762,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -318916,7 +324773,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -318944,15 +324808,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -318961,7 +324826,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -319070,8 +324936,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -319123,8 +324989,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -319138,8 +325004,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -319194,7 +325060,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -319233,8 +325100,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -319445,10 +325312,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -319527,17 +325395,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -319549,7 +325417,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -319569,9 +325437,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -319579,10 +325449,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -319625,7 +325496,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -319706,11 +325577,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -319759,22 +325631,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -319787,14 +325661,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -319818,7 +325693,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -319885,10 +325760,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -319896,7 +325771,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -319924,15 +325806,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -319941,7 +325824,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -320050,8 +325934,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -320103,8 +325987,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -320118,8 +326002,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -320174,7 +326058,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -320213,8 +326098,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -320425,10 +326310,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -320507,17 +326393,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -320529,7 +326415,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -320549,9 +326435,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -320559,10 +326447,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -320605,7 +326494,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -320686,11 +326575,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -320739,22 +326629,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -320767,14 +326659,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -320798,7 +326691,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -320865,10 +326758,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -320876,7 +326769,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -320904,15 +326804,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -320921,7 +326822,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -321030,8 +326932,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -321083,8 +326985,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -321098,8 +327000,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -321154,7 +327056,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -321193,8 +327096,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -321405,10 +327308,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -321487,17 +327391,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -321509,7 +327413,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -321529,9 +327433,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -321539,10 +327445,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -321585,7 +327492,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -321666,11 +327573,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -321719,22 +327627,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -321747,14 +327657,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -321778,7 +327689,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -321845,10 +327756,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -321856,7 +327767,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -321884,15 +327802,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -321901,7 +327820,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -322010,8 +327930,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -322063,8 +327983,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -322078,8 +327998,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -322134,7 +328054,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -322173,8 +328094,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -322385,10 +328306,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -322467,17 +328389,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -322489,7 +328411,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -322509,9 +328431,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -322519,10 +328443,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -322565,7 +328490,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -322646,11 +328571,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -322699,22 +328625,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -322727,14 +328655,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -322758,7 +328687,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -322825,10 +328754,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -322836,7 +328765,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -322864,15 +328800,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -322881,7 +328818,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -322990,8 +328928,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -323043,8 +328981,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -323058,8 +328996,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -323114,7 +329052,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -323153,8 +329092,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -323365,10 +329304,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -323447,17 +329387,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -323469,7 +329409,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -323489,9 +329429,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -323499,10 +329441,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -323545,7 +329488,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -323626,11 +329569,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -323679,22 +329623,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -323707,14 +329653,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -323738,7 +329685,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -323805,10 +329752,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -323816,7 +329763,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -323844,15 +329798,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -323861,7 +329816,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -323970,8 +329926,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -324023,8 +329979,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -324038,8 +329994,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -324094,7 +330050,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -324133,8 +330090,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -324345,10 +330302,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -324427,17 +330385,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -324449,7 +330407,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -324469,9 +330427,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -324479,10 +330439,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -324525,7 +330486,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -324606,11 +330567,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -324659,22 +330621,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -324687,14 +330651,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -324718,7 +330683,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -324785,10 +330750,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -324796,7 +330761,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -324824,15 +330796,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -324841,7 +330814,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -324950,8 +330924,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -325003,8 +330977,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -325018,8 +330992,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -325074,7 +331048,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -325113,8 +331088,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -325325,10 +331300,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -325407,17 +331383,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -325429,7 +331405,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -325449,9 +331425,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -325459,10 +331437,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -325505,7 +331484,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -325586,11 +331565,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -325639,22 +331619,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -325667,14 +331649,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -325698,7 +331681,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -325765,10 +331748,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -325776,7 +331759,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -325804,15 +331794,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -325821,7 +331812,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -325930,8 +331922,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -325983,8 +331975,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -325998,8 +331990,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -326054,7 +332046,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -326093,8 +332086,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -326305,10 +332298,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -326387,17 +332381,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -326409,7 +332403,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -326429,9 +332423,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -326439,10 +332435,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -326485,7 +332482,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -326566,11 +332563,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -326619,22 +332617,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -326647,14 +332647,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -326678,7 +332679,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -326745,10 +332746,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -326756,7 +332757,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -326784,15 +332792,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -326801,7 +332810,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -326910,8 +332920,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -326963,8 +332973,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -326978,8 +332988,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -327034,7 +333044,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -327073,8 +333084,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -327285,10 +333296,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -327367,17 +333379,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -327389,7 +333401,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -327409,9 +333421,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -327419,10 +333433,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -327465,7 +333480,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -327546,11 +333561,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -327599,22 +333615,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -327627,14 +333645,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -327658,7 +333677,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -327725,10 +333744,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -327736,7 +333755,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -327764,15 +333790,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -327781,7 +333808,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -327890,8 +333918,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -327943,8 +333971,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -327958,8 +333986,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -328014,7 +334042,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -328053,8 +334082,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -328265,10 +334294,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -328347,17 +334377,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -328369,7 +334399,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -328389,9 +334419,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -328399,10 +334431,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -328445,7 +334478,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -328526,11 +334559,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -328579,22 +334613,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -328607,14 +334643,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -328638,7 +334675,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -328705,10 +334742,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -328716,7 +334753,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -328744,15 +334788,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -328761,7 +334806,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -328870,8 +334916,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -328923,8 +334969,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -328938,8 +334984,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -328994,7 +335040,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -329033,8 +335080,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -329245,10 +335292,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -329327,17 +335375,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -329349,7 +335397,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -329369,9 +335417,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -329379,10 +335429,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -329425,7 +335476,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -329506,11 +335557,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -329559,22 +335611,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -329587,14 +335641,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -329618,7 +335673,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -329685,10 +335740,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -329696,7 +335751,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -329724,15 +335786,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -329741,7 +335804,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -329850,8 +335914,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -329903,8 +335967,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -329918,8 +335982,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -329974,7 +336038,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -330013,8 +336078,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -330225,10 +336290,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -330307,17 +336373,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -330329,7 +336395,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -330349,9 +336415,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -330359,10 +336427,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -330405,7 +336474,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -330486,11 +336555,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -330539,22 +336609,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -330567,14 +336639,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -330598,7 +336671,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -330665,10 +336738,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -330676,7 +336749,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -330704,15 +336784,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -330721,7 +336802,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -330830,8 +336912,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -330883,8 +336965,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -330898,8 +336980,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -330954,7 +337036,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -330993,8 +337076,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -331205,10 +337288,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -331287,17 +337371,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -331309,7 +337393,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -331329,9 +337413,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -331339,10 +337425,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -331385,7 +337472,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -331466,11 +337553,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -331519,22 +337607,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -331547,14 +337637,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -331578,7 +337669,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -331645,10 +337736,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -331656,7 +337747,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -331684,15 +337782,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -331701,7 +337800,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -331810,8 +337910,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -331863,8 +337963,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -331878,8 +337978,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -331934,7 +338034,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -331973,8 +338074,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -332185,10 +338286,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -332267,17 +338369,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -332289,7 +338391,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -332309,9 +338411,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -332319,10 +338423,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -332365,7 +338470,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -332446,11 +338551,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -332499,22 +338605,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -332527,14 +338635,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -332558,7 +338667,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -332625,10 +338734,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -332636,7 +338745,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -332664,15 +338780,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -332681,7 +338798,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -332790,8 +338908,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -332843,8 +338961,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -332858,8 +338976,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -332914,7 +339032,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -332953,8 +339072,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -333165,10 +339284,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -333247,17 +339367,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -333269,7 +339389,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -333289,9 +339409,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -333299,10 +339421,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -333345,7 +339468,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -333426,11 +339549,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -333479,22 +339603,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -333507,14 +339633,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -333538,7 +339665,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -333605,10 +339732,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -333616,7 +339743,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -333644,15 +339778,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -333661,7 +339796,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -333770,8 +339906,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -333823,8 +339959,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -333838,8 +339974,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -333894,7 +340030,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -333933,8 +340070,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -334145,10 +340282,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -334227,17 +340365,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -334249,7 +340387,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -334269,9 +340407,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -334279,10 +340419,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -334325,7 +340466,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -334406,11 +340547,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -334459,22 +340601,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -334487,14 +340631,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -334518,7 +340663,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -334585,10 +340730,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -334596,7 +340741,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -334624,15 +340776,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -334641,7 +340794,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -334750,8 +340904,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -334803,8 +340957,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -334818,8 +340972,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -334874,7 +341028,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -334913,8 +341068,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -335125,10 +341280,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -335207,17 +341363,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -335229,7 +341385,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -335249,9 +341405,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -335259,10 +341417,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -335305,7 +341464,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -335386,11 +341545,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -335439,22 +341599,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -335467,14 +341629,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -335498,7 +341661,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -335565,10 +341728,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -335576,7 +341739,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -335604,15 +341774,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -335621,7 +341792,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -335730,8 +341902,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -335783,8 +341955,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -335798,8 +341970,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -335854,7 +342026,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -335893,8 +342066,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -336105,10 +342278,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -336187,17 +342361,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -336209,7 +342383,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -336229,9 +342403,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -336239,10 +342415,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -336285,7 +342462,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -336366,11 +342543,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -336419,22 +342597,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -336447,14 +342627,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -336478,7 +342659,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -336545,10 +342726,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -336556,7 +342737,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -336584,15 +342772,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -336601,7 +342790,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -336710,8 +342900,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -336763,8 +342953,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -336778,8 +342968,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -336834,7 +343024,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -336873,8 +343064,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -337085,10 +343276,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -337167,17 +343359,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -337189,7 +343381,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -337209,9 +343401,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -337219,10 +343413,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -337265,7 +343460,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -337346,11 +343541,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -337399,22 +343595,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -337427,14 +343625,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -337458,7 +343657,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -337525,10 +343724,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -337536,7 +343735,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -337564,15 +343770,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -337581,7 +343788,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -337690,8 +343898,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -337743,8 +343951,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -337758,8 +343966,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -337814,7 +344022,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -337853,8 +344062,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -338065,10 +344274,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -338147,17 +344357,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -338169,7 +344379,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -338189,9 +344399,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -338199,10 +344411,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -338245,7 +344458,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -338326,11 +344539,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -338379,22 +344593,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -338407,14 +344623,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -338438,7 +344655,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -338505,10 +344722,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -338516,7 +344733,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -338544,15 +344768,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -338561,7 +344786,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -338670,8 +344896,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -338723,8 +344949,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -338738,8 +344964,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -338794,7 +345020,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -338833,8 +345060,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -339045,10 +345272,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -339127,17 +345355,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -339149,7 +345377,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -339169,9 +345397,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -339179,10 +345409,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -339225,7 +345456,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -339306,11 +345537,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -339359,22 +345591,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -339387,14 +345621,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -339418,7 +345653,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -339485,10 +345720,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -339496,7 +345731,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -339524,15 +345766,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -339541,7 +345784,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -339650,8 +345894,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -339703,8 +345947,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -339718,8 +345962,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -339774,7 +346018,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -339813,8 +346058,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -340025,10 +346270,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -340107,17 +346353,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -340129,7 +346375,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -340149,9 +346395,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -340159,10 +346407,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -340205,7 +346454,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -340286,11 +346535,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -340339,22 +346589,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -340367,14 +346619,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -340398,7 +346651,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -340465,10 +346718,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -340476,7 +346729,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -340504,15 +346764,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -340521,7 +346782,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -340630,8 +346892,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -340683,8 +346945,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -340698,8 +346960,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -340754,7 +347016,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -340793,8 +347056,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -341005,10 +347268,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -341087,17 +347351,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -341109,7 +347373,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -341129,9 +347393,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -341139,10 +347405,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -341185,7 +347452,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -341266,11 +347533,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -341319,22 +347587,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -341347,14 +347617,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -341378,7 +347649,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -341445,10 +347716,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -341456,7 +347727,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -341484,15 +347762,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -341501,7 +347780,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -341610,8 +347890,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -341663,8 +347943,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -341678,8 +347958,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -341734,7 +348014,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -341773,8 +348054,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -341985,10 +348266,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -342067,17 +348349,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -342089,7 +348371,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -342109,9 +348391,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -342119,10 +348403,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -342165,7 +348450,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -342246,11 +348531,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -342299,22 +348585,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -342327,14 +348615,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -342358,7 +348647,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -342425,10 +348714,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -342436,7 +348725,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -342464,15 +348760,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -342481,7 +348778,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -342590,8 +348888,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -342643,8 +348941,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -342658,8 +348956,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -342714,7 +349012,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -342753,8 +349052,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -342965,10 +349264,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -343047,17 +349347,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -343069,7 +349369,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -343089,9 +349389,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -343099,10 +349401,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -343145,7 +349448,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -343226,11 +349529,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -343279,22 +349583,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -343307,14 +349613,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -343338,7 +349645,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -343405,10 +349712,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -343416,7 +349723,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -343444,15 +349758,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -343461,7 +349776,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -343570,8 +349886,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -343623,8 +349939,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -343638,8 +349954,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -343694,7 +350010,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -343733,8 +350050,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -343945,10 +350262,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -344027,17 +350345,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -344049,7 +350367,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -344069,9 +350387,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -344079,10 +350399,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -344125,7 +350446,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -344206,11 +350527,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -344259,22 +350581,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -344287,14 +350611,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -344318,7 +350643,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -344385,10 +350710,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -344396,7 +350721,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -344424,15 +350756,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -344441,7 +350774,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -344550,8 +350884,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -344603,8 +350937,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -344618,8 +350952,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -344674,7 +351008,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -344713,8 +351048,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -344925,10 +351260,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -345007,17 +351343,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -345029,7 +351365,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -345049,9 +351385,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -345059,10 +351397,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -345105,7 +351444,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -345186,11 +351525,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -345239,22 +351579,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -345267,14 +351609,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -345298,7 +351641,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -345365,10 +351708,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -345376,7 +351719,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -345404,15 +351754,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -345421,7 +351772,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -345530,8 +351882,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -345583,8 +351935,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -345598,8 +351950,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -345654,7 +352006,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -345693,8 +352046,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -345905,10 +352258,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -345987,17 +352341,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -346009,7 +352363,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -346029,9 +352383,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -346039,10 +352395,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -346085,7 +352442,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -346166,11 +352523,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -346219,22 +352577,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -346247,14 +352607,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -346278,7 +352639,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -346345,10 +352706,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -346356,7 +352717,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -346384,15 +352752,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -346401,7 +352770,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -346510,8 +352880,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -346563,8 +352933,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -346578,8 +352948,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -346634,7 +353004,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -346673,8 +353044,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -346885,10 +353256,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -346967,17 +353339,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -346989,7 +353361,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -347009,9 +353381,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -347019,10 +353393,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -347065,7 +353440,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -347146,11 +353521,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -347199,22 +353575,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -347227,14 +353605,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -347258,7 +353637,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -347325,10 +353704,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -347336,7 +353715,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -347364,15 +353750,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -347381,7 +353768,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -347490,8 +353878,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -347543,8 +353931,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -347558,8 +353946,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -347614,7 +354002,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -347653,8 +354042,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -347865,10 +354254,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -347947,17 +354337,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -347969,7 +354359,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -347989,9 +354379,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -347999,10 +354391,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -348045,7 +354438,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -348126,11 +354519,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -348179,22 +354573,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -348207,14 +354603,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -348238,7 +354635,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -348305,10 +354702,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -348316,7 +354713,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -348344,15 +354748,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -348361,7 +354766,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -348470,8 +354876,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -348523,8 +354929,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -348538,8 +354944,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -348594,7 +355000,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -348633,8 +355040,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -348845,10 +355252,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -348927,17 +355335,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -348949,7 +355357,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -348969,9 +355377,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -348979,10 +355389,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -349025,7 +355436,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -349106,11 +355517,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -349159,22 +355571,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -349187,14 +355601,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -349218,7 +355633,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -349285,10 +355700,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -349296,7 +355711,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -349324,15 +355746,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -349341,7 +355764,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -349450,8 +355874,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -349503,8 +355927,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -349518,8 +355942,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -349574,7 +355998,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -349613,8 +356038,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -349825,10 +356250,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -349907,17 +356333,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -349929,7 +356355,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -349949,9 +356375,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -349959,10 +356387,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -350005,7 +356434,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -350086,11 +356515,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -350139,22 +356569,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -350167,14 +356599,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -350198,7 +356631,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -350265,10 +356698,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -350276,7 +356709,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -350304,15 +356744,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -350321,7 +356762,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -350430,8 +356872,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -350483,8 +356925,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -350498,8 +356940,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -350554,7 +356996,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -350593,8 +357036,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -350805,10 +357248,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -350887,17 +357331,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -350909,7 +357353,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -350929,9 +357373,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -350939,10 +357385,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -350985,7 +357432,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -351066,11 +357513,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -351119,22 +357567,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -351147,14 +357597,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -351178,7 +357629,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -351245,10 +357696,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -351256,7 +357707,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -351284,15 +357742,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -351301,7 +357760,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -351410,8 +357870,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -351463,8 +357923,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -351478,8 +357938,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -351534,7 +357994,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -351573,8 +358034,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -351785,10 +358246,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -351867,17 +358329,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -351889,7 +358351,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -351909,9 +358371,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -351919,10 +358383,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -351965,7 +358430,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -352046,11 +358511,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -352099,22 +358565,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -352127,14 +358595,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -352158,7 +358627,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -352225,10 +358694,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -352236,7 +358705,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -352264,15 +358740,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -352281,7 +358758,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -352390,8 +358868,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -352443,8 +358921,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -352458,8 +358936,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -352514,7 +358992,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -352553,8 +359032,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -352765,10 +359244,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -352847,17 +359327,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -352869,7 +359349,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -352889,9 +359369,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -352899,10 +359381,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -352945,7 +359428,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -353026,11 +359509,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -353079,22 +359563,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -353107,14 +359593,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -353138,7 +359625,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -353205,10 +359692,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -353216,7 +359703,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -353244,15 +359738,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -353261,7 +359756,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -353370,8 +359866,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -353423,8 +359919,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -353438,8 +359934,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -353494,7 +359990,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -353533,8 +360030,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -353745,10 +360242,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -353827,17 +360325,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -353849,7 +360347,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -353869,9 +360367,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -353879,10 +360379,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -353925,7 +360426,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -354006,11 +360507,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -354059,22 +360561,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -354087,14 +360591,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -354118,7 +360623,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -354185,10 +360690,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -354196,7 +360701,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -354224,15 +360736,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -354241,7 +360754,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -354350,8 +360864,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -354403,8 +360917,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -354418,8 +360932,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -354474,7 +360988,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -354513,8 +361028,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -354725,10 +361240,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -354807,17 +361323,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -354829,7 +361345,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -354849,9 +361365,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -354859,10 +361377,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -354905,7 +361424,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -354986,11 +361505,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -355039,22 +361559,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -355067,14 +361589,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -355098,7 +361621,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -355165,10 +361688,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -355176,7 +361699,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -355204,15 +361734,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -355221,7 +361752,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -355330,8 +361862,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -355383,8 +361915,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -355398,8 +361930,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -355454,7 +361986,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -355493,8 +362026,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -355705,10 +362238,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -355787,17 +362321,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -355809,7 +362343,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -355829,9 +362363,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -355839,10 +362375,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -355885,7 +362422,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -355966,11 +362503,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -356019,22 +362557,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -356047,14 +362587,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -356078,7 +362619,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -356145,10 +362686,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -356156,7 +362697,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -356184,15 +362732,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -356201,7 +362750,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -356310,8 +362860,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -356363,8 +362913,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -356378,8 +362928,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -356434,7 +362984,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -356473,8 +363024,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -356685,10 +363236,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -356767,17 +363319,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -356789,7 +363341,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -356809,9 +363361,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -356819,10 +363373,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -356865,7 +363420,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -356946,11 +363501,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -356999,22 +363555,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -357027,14 +363585,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -357058,7 +363617,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -357125,10 +363684,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -357136,7 +363695,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -357164,15 +363730,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -357181,7 +363748,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -357290,8 +363858,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -357343,8 +363911,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -357358,8 +363926,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -357414,7 +363982,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -357453,8 +364022,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -357665,10 +364234,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -357747,17 +364317,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -357769,7 +364339,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -357789,9 +364359,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -357799,10 +364371,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -357845,7 +364418,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -357926,11 +364499,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -357979,22 +364553,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -358007,14 +364583,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -358038,7 +364615,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -358105,10 +364682,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -358116,7 +364693,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -358144,15 +364728,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -358161,7 +364746,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -358270,8 +364856,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -358323,8 +364909,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -358338,8 +364924,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -358394,7 +364980,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -358433,8 +365020,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -358645,10 +365232,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0
@@ -358727,17 +365315,17 @@ T1222.002,No,-,0
T1110.001,No,-,0
T1216.001,No,-,0
T1597.002,No,-,0
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,31
-T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,31
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_conversion_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_dsinternals_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_s_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_fgdump_cachedump_v_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_getaddbaccount_from_dump.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_lazagne_command_options.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_mimikatz_modules.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_kernel_peek.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_ms_debuggers_z_option.yml,32
+T1003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___credential_extraction_powersploit_modules.yml,32
T1129,No,-,0
T1602,No,-,0
T1561.002,No,-,0
@@ -358749,7 +365337,7 @@ T1006,No,-,0
T1044,No,-,0
T1491.002,No,-,0
T1171,No,-,0
-T1590.005,No,-,0
+T1590.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_connecting_to_ip_check_web_services.yml,1
T1499.001,No,-,0
T1014,No,-,0
T1546.013,No,-,0
@@ -358769,9 +365357,11 @@ T1546.006,No,-,0
T1539,No,-,0
T1053.007,No,-,0
T1568.002,No,-,0
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,3
-T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,3
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_remote_user_account_control.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/eventvwr_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/fodhelper_uac_bypass.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_runas_elevated.yml,5
+T1548.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/slui_spawning_a_process.yml,5
T1099,No,-,0
T1016.001,No,-,0
T1548.003,No,-,0
@@ -358779,10 +365369,11 @@ T1560.003,No,-,0
T1578,No,-,0
T1069,No,-,1
T1114,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_pst_export_alert.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,4
-T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,4
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/attempted_credential_dump_from_registry_via_reg_exe.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_powershell.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/excel_spawning_windows_script_host.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/extract_sam_from_registry.yml,5
+T1003.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/process_deleting_its_process_file_path.yml,5
T1596.002,No,-,0
T1542.001,No,-,0
T1594,No,-,0
@@ -358825,7 +365416,7 @@ T1489,Yes,https://github.com/splunk/security_content/blob/develop/detections/win
T1587.001,No,-,0
T1121,No,-,0
T1206,No,-,0
-T1087.002,No,-,0
+T1087.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/account_discovery_with_net_app.yml,1
T1547.014,No,-,0
T1564,No,-,2
T1559.002,No,-,0
@@ -358906,11 +365497,12 @@ T1505.002,No,-,0
T1082,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_information_discovery_detection.yml,1
T1071,No,-,3
T1074.002,No,-,0
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/shedule_task_with_http_command_arguments.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,12
-T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,12
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_http_command_arguments.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/schedule_task_with_rundll32_command_trigger.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml,13
+T1053,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,13
T1218.007,No,-,0
T1162,No,-,0
T1590.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml,1
@@ -358959,22 +365551,24 @@ T1546.011,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1552,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,1
T1547.010,Yes,https://github.com/splunk/security_content/blob/develop/detections/monitor_registry_keys_for_print_monitors.yml,1
T1037.002,No,-,0
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,12
-T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,12
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/cobalt_strike_named_pipes.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/dllhost_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/gpupdate_with_no_command_line_arguments_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/powershell_remote_thread_to_known_windows_process.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/searchprotocolhost_with_no_command_line_with_network.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_dllhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_gpupdate_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_searchprotocolhost_no_command_line_arguments.yml,14
+T1055,Yes,https://github.com/splunk/security_content/blob/develop/detections/trickbot_named_pipe.yml,14
T1139,No,-,0
T1205,No,-,0
T1503,No,-,0
-T1218,No,-,27
+T1218,No,-,28
T1153,No,-,0
T1038,No,-,0
T1050,No,-,0
@@ -358987,14 +365581,15 @@ T1087.003,No,-,0
T1062,No,-,0
T1497.003,No,-,0
T1182,No,-,0
-T1218.003,No,-,0
+T1218.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/cmlua_or_cmstplua_uac_bypass.yml,1
T1563.001,No,-,0
T1562.002,No,-,0
T1029,No,-,0
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,4
-T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,4
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_psexec_with_accepteula_flag.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_mimikatz_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_shares_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_connectivity_via_powersploit_modules.yml,5
+T1021.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/write_executable_in_smb_share.yml,5
T1525,Yes,https://github.com/splunk/security_content/blob/develop/detections/gcp_gcr_container_uploaded.yml,1
T1572,No,-,0
T1218.002,No,-,0
@@ -359018,7 +365613,7 @@ T1152,No,-,0
T1553.003,No,-,0
T1483,No,-,0
T1185,No,-,0
-T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,5
+T1021,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_access_user_content_via_powersploit_modules.yml,6
T1071.003,No,-,0
T1595.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_defensive_tools_via_powersploit_modules.yml,1
T1596,No,-,0
@@ -359085,10 +365680,10 @@ T1053.001,No,-,0
T1179,No,-,0
T1595,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,2
T1547.011,No,-,0
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,7
-T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,7
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml,9
+T1548,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml,9
T1134.002,No,-,0
T1548.001,No,-,0
T1547.004,No,-,0
@@ -359096,7 +365691,14 @@ T1019,No,-,0
T1021.003,No,-,0
T1042,No,-,0
T1117,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,1
-T1110.003,No,-,0
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_failing_to_authenticate_from_process.yml,8
+T1110.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/multiple_users_remotely_failing_to_authenticate_from_host.yml,8
T1090.002,No,-,0
T1056.003,No,-,0
T1589.002,No,-,0
@@ -359124,15 +365726,16 @@ T1574.005,No,-,0
T1546.008,Yes,https://github.com/splunk/security_content/blob/develop/detections/overwriting_accessibility_binaries.yml,1
T1504,No,-,0
T1198,No,-,0
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,4
-T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___assess_credential_strength_via_dsinternals_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml,5
+T1087,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1090,No,-,0
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,18
-T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,18
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___rare_parent_process_relationship_lolbas.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___first_time_seen_cmd_line.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___prohibited_apps_spawning_cmdprompt.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___unusual_lolbas_in_short_period_of_time.yml,19
+T1059,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_spawned_cmd_or_powershell_process.yml,19
T1562.006,No,-,0
T1136.002,No,-,0
T1589.003,No,-,0
@@ -359141,7 +365744,8 @@ T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/nlt
T1482,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,3
T1558.001,No,-,0
T1175,No,-,0
-T1020,No,-,0
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_rclone_command_line_usage.yml,2
+T1020,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_renamed_rclone.yml,2
T1592.004,No,-,0
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_created_with_all_open_ports.yml,4
T1562.007,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_network_access_control_list_deleted.yml,4
@@ -359250,8 +365854,8 @@ T1015,No,-,0
T1212,No,-,0
T1546.014,No,-,0
T1102.003,No,-,0
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,4
-T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,4
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml,5
+T1590,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml,5
T1210,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_computer_changed_with_anonymous_account.yml,1
T1502,No,-,0
T1142,No,-,0
@@ -359303,8 +365907,8 @@ T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1218.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_html_help_using_infotech_storage_handlers.yml,4
T1070.005,Yes,https://github.com/splunk/security_content/blob/develop/detections/create_or_delete_windows_shares_using_net_exe.yml,1
T1090.003,No,-,0
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,2
-T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,2
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/aws_iam_assume_role_policy_brute_force.yml,10
+T1110,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_excessive_authentication_failures_alert.yml,10
T1059.004,No,-,0
T1137.003,No,-,0
T1157,No,-,0
@@ -359318,8 +365922,8 @@ T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_firewall_with_netsh.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_folderoptions_windows_feature.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_norun_windows_app.yml,14
-T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_systemrestore_in_registry.yml,14
+T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/disabling_task_manager.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/unload_sysmon_filter_driver.yml,14
T1562.001,Yes,https://github.com/splunk/security_content/blob/develop/detections/windows_disableantispyware_reg.yml,14
T1565,No,-,0
@@ -359374,7 +365978,8 @@ T1068,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa
T1531,No,-,0
T1110.004,No,-,0
T1208,No,-,0
-T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,1
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/malicious_powershell_process___encoded_command.yml,2
+T1027,Yes,https://github.com/splunk/security_content/blob/develop/detections/wermgr_process_create_executable_file.yml,2
T1114.002,Yes,https://github.com/splunk/security_content/blob/develop/detections/o365_suspicious_rights_delegation.yml,1
T1036.001,No,-,0
T1564.006,No,-,0
@@ -359413,8 +366018,8 @@ T1589.001,Yes,https://github.com/splunk/security_content/blob/develop/detections
T1195.002,No,-,0
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_spaces_before_extension.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/execution_of_file_with_multiple_extensions.yml,7
-T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_path.yml,7
+T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_microsoft_workflow_compiler_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_msbuild_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/suspicious_rundll32_rename.yml,7
T1036.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml,7
@@ -359625,10 +366230,11 @@ T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/o36
T1556,Yes,https://github.com/splunk/security_content/blob/develop/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml,3
T1056.004,No,-,0
T1495,No,-,0
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,4
-T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,4
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/bcdedit_failure_recovery_modification.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/deleting_shadow_copies.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/resize_shadowstorage_volume.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/wbadmin_delete_system_backups.yml,5
+T1490,Yes,https://github.com/splunk/security_content/blob/develop/detections/delete_shadowcopy_with_powershell.yml,5
T1546.007,No,-,0
T1566.003,Yes,https://github.com/splunk/security_content/blob/develop/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml,1
T1090.001,No,-,0